OpenID Connect
Security research on OpenID Connect clients and providers, and the checks that prevent the documented attacks.
Entries
- What is inside a JWT?
A signed JWT is 3 base64url-encoded parts joined by dots: a header that names the algorithm, a payload of claims, and a signature over both. The payload is encoded, not encrypted, so anyone holding the token can read it; …
- Where do OpenID Connect implementations break?
Implementations break mostly where tokens and redirects get checked. Documented attacks on relying parties include token substitution, key confusion and replay, and attacks on providers include redirect URI manipulation, …
Track revisions: changes (RSS) JSON Feed all findings (JSON) Glossary