OpenID Connect (OIDC)

Also Known As

TL;DR

Explanation

OpenID Connect adds to OAuth 2.0: an ID token (JWT containing user identity claims — sub, name, email, picture), a UserInfo endpoint (fetch additional claims), and a discovery document (/.well-known/openid-configuration lists all endpoints). The ID token is for the client application (to know who logged in); the access token is for calling APIs. Flow: same as OAuth 2.0 authorization_code flow but with openid scope added. PHP libraries: league/oauth2-client, thephpleague/oauth2-google, lcobucci/jwt for token validation.

Common Misconception

Why It Matters

Common Mistakes

• Using the OAuth access token to identify the user — access tokens are for calling APIs, not authentication.
• Not validating the ID token signature — anyone can craft a JWT without signature validation.
• Not checking the aud (audience) claim — ID tokens from other clients can be replayed.
• Not verifying the nonce — prevents ID token replay attacks.

Code Examples

// Using access token for identity — wrong:
$accessToken = $oauth->getAccessToken('authorization_code', ['code' => $_GET['code']]);
// Access token is opaque — you don't know who this user is from the token alone
$user = $googleApi->getUser($accessToken->getToken()); // Extra API call needed
// Token may belong to any Google user

// OIDC — ID token contains verified identity:
$provider = new Google(['clientId' => ..., 'redirectUri' => ...]);
$tokens = $provider->getAccessToken('authorization_code', [
    'code' => $_GET['code'],
    'scope' => 'openid email profile',
]);

// ID token: JWT with signed identity claims
$idToken = $tokens->getValues()['id_token'];
$claims  = $jwtValidator->validate($idToken, [
    'iss' => 'https://accounts.google.com',
    'aud' => CLIENT_ID,
    'nonce' => $_SESSION['oauth_nonce'],
]);
$userId = $claims['sub']; // Stable user identifier

References

• ↗ https://openid.net/specs/openid-connect-core-1_0.html

Tags

Related Terms