Security

What is OpenID Connect?

Also known as: OIDC

Definition

OpenID Connect (OIDC) is an identity authentication layer built on OAuth 2.0 that provides a signed ID token containing verified user identity claims.

OpenID Connect (OIDC) is an identity authentication protocol that extends OAuth 2.0 with a standardized mechanism for verifying the identity of an end user. It was developed by the OpenID Foundation and published as a set of specifications in February 2014. OIDC adds a signed JSON Web Token (JWT) called an ID token, which contains claims about the authenticated user such as their name, email address, and a unique subject identifier.

When a client application wants to authenticate a user, it initiates an OIDC flow by redirecting the user to an OpenID Provider (OP). The OP authenticates the user and returns an authorization code to the client. The client exchanges this code for an ID token and an access token from the OP's token endpoint. The client validates the ID token's signature using the OP's public keys (fetched from a JWKS URI) and checks the token's issuer, audience, and expiration. The access token can then be used to retrieve additional user information from the UserInfo endpoint.

OIDC sits on top of OAuth 2.0, reusing its authorization framework, token endpoints, and client registration. While OAuth 2.0 alone provides delegated authorization (what the user allows the client to do), OIDC adds authentication (who the user is). OIDC supports multiple flows: the authorization code flow for server-side applications, the implicit flow for browser-based apps (now discouraged), and the hybrid flow. It also defines discovery (via a well-known configuration endpoint) and dynamic client registration, making it the dominant identity protocol for modern web and mobile applications.

Key facts

  • Built on OAuth 2.0, adding an ID token for user authentication.
  • ID token is a signed JWT containing claims like sub, name, and email.
  • Supports authorization code, implicit, and hybrid flows.
  • Defined by the OpenID Foundation in 2014, with core spec at OpenID.Core.
  • Provides a UserInfo endpoint to fetch additional identity claims.

How it works in practice

A user logs into a third-party website using their Google account. The website redirects the user to Google's OIDC endpoint. After the user authenticates, Google returns an ID token to the website. The website validates the token's signature and extracts the user's email and unique ID. It then uses the access token to fetch the user's profile picture from Google's UserInfo endpoint. The website now knows who the user is without ever handling a password.

Related terms

OAuth 2.0 JSON Web Token (JWT) SAML 2.0 OpenID UserInfo endpoint JWKS

References

More in Security

2FA

Two-factor authentication (2FA) is a security method that requires a user to present two distinct types of evidence to verify their identity, typically a password and a time-based one-time code from an authenticator app or hardware key.

Bot Management

Bot management detects automated web traffic and distinguishes it from human users, using behavioral fingerprinting and other signals to block malicious bots while allowing benign ones.

Credential Stuffing

Credential stuffing is a cyberattack in which automated tools use username-password pairs leaked from one site to try logging into other sites, exploiting password reuse.

DDoS

A DDoS (Distributed Denial of Service) attack overwhelms a target server, service, or network with massive traffic from many compromised computers, making it unavailable to legitimate users.

DDoS Scrubbing

DDoS scrubbing diverts attack traffic to a specialized filtering facility that removes malicious packets and forwards only legitimate traffic to the target network.

Firewall

A network security device or software that monitors and controls incoming and outgoing traffic based on predetermined security rules, acting as a barrier between trusted and untrusted networks.

IDS

An Intrusion Detection System (IDS) monitors network traffic or host activity for signs of malicious behavior or policy violations and generates alerts for security personnel.

IPS

An Intrusion Prevention System (IPS) is a network security device that monitors traffic inline and actively blocks malicious packets before they reach their target.

OAuth 2.0

OAuth 2.0 is an authorization framework that allows a user to grant a third-party application limited access to their resources on another service without revealing their password.

Passkey

A passkey is a FIDO2/WebAuthn credential stored on a user's device that replaces passwords with public-key cryptography for authentication.

Who Is Online

In total there are 52 users online: 0 registered, 46 guests and 6 bots.

Most users ever online was 5,555 on 17 Jul 2026, 3:23 am.

Bots: Applebot Baiduspider Other Bot Other Crawler PetalBot SemrushBot

Users active in the past 15 minutes. Total registered members: 369