---
title: "OpenID Connect"
canonical_url: https://www.janbrennenstuhl.eu/knowledge-base/oidc/
author: Jan Brennenstuhl
---

# OpenID Connect

Security research on OpenID Connect clients and providers, and the checks that prevent the documented attacks.



## Entries

- [What is inside a JWT?](https://www.janbrennenstuhl.eu/knowledge-base/oidc/jwt-anatomy/) (2026-10-13, guide): A signed JWT's claims are readable by anyone who holds it; trust comes only from verifying the signature with an allowed algorithm and a trusted key. Markdown: https://www.janbrennenstuhl.eu/knowledge-base/oidc/jwt-anatomy/index.md
- [Where do OpenID Connect implementations break?](https://www.janbrennenstuhl.eu/knowledge-base/oidc/openid-connect-security/) (2023-05-15, guide): Testing 6 certified OpenID providers and 8 relying parties against 18 known attacks uncovered 12 implementation flaws. Markdown: https://www.janbrennenstuhl.eu/knowledge-base/oidc/openid-connect-security/index.md