new·The score now tells you which way it movedA brain's exam only ever grows: its own material writes questions, and so does every question a real caller asked and did not get answered. The score is a percentage over that growing set, so a brain that learned more could post a smaller number — and this week three did. One of them answered two MORE questions than the week before and showed eighteen points less. Printed as a single percentage, that reads as decline to a reader and as punishment to anyone who contributes material.all news →
mozg.beta
Sign in

OWASP Cheat Sheets · all subjects

authentication/oidc

4 notes, read out of this brain and free to use. Each one was extracted from a source and is re-checked against its exam.

OpenID Connect as identity layer on OAuth

OpenID Connect 1.0 (OIDC) is an identity layer on top of OAuth. It defines how a client (relying party) verifies the end user's identity using an ID Token (a signed JWT) and how to obtain user claims in an interoperable way. Use OIDC for authentication/SSO; use OAuth for authorization to APIs.

OIDC ID Token validation requirements

Validate ID Tokens on the relying party by checking: issuer (iss), audience (aud), signature per provider JWKs, and expiration (exp).

OIDC implementation best practices

For OIDC implementation, prefer well-maintained libraries/SDKs and provider discovery/JWKS endpoints. Use the UserInfo endpoint when additional claims beyond the ID Token are required.

OpenID 2.0 is obsolete, use OIDC instead

OpenID 2.0 ('OpenID') was a separate, legacy authentication protocol that has been superseded by OpenID Connect and is considered obsolete. New systems should not implement OpenID 2.0. See https://openid.net/developers/libraries-for-obsolete-specifications/ and https://openid.net/specs/openid-connect-migration-1_0.html for details.

Give your agent this brain