Tools, FAQ, Tutorials:
Validate Google OpenID Connect id_token
How to validate the id_token value received from Google OpenID Connect authentication response?
✍: FYIcenter.com
As you can see from the previous tutorials, you can easily decode the
"id_token" value received from Google OpenID Connect authentication response using a
simple PHP script.
After decoding, you can get all information about the end user from the body component, and trust it without any validation.
But, since the "id_token" is included in the authentication response delivered over the public Internet, you should not trust it and perform a number validation steps:
1. Data structure validation.
2. Data attributes validation.
3. Timestamp attributes validation. This will prevent someone to repost the authentication response to your server script at a later time.
4. "nonce" protection and validation. This will prevent someone to repost the authentication response again immediately.
5. Signature validation. This is to ensure the entire authentication response message has not been modified by someone else. See next tutorial on how to perform "id_token" signature validation.
⇒ Validate Google OpenID Connect id_token Signature
⇐ Decode Google OpenID Connect id_token
2022-02-04, 1619🔥, 0💬
Popular Posts:
How to install "C++/CLI Support" component in Visual Studio? I need to build my Visual Studio C++/CL...
How to reinstall npm with a node version manager? I am getting permission errors with the current ve...
Where to find tutorials on Microsoft Azure services? Here is a large collection of tutorials to answ...
FYIcenter JSON Validator and Formatter is an online tool that checks for syntax errors of JSON text ...
How to use the "rewrite-uri" Policy Statement for an Azure API service operation? The "rewrite-uri" ...