PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchFor redirect-based sign-in, use OpenID Connect (OIDC) on top of OAuth 2.0, with authorization code flow and PKCE. Keep the ID token and access token’s jobs separate, bind each authorization request to its response, and validate the ID token before trusting its identity claims. OAuth 2.0 authorizes access to protected resources; OIDC adds an authentication protocol and an ID token that describes the authentication event.
What is the difference between OAuth 2.0 and OpenID Connect?
OAuth 2.0 is an authorization framework: it lets a client obtain limited access to protected resources. By itself, it is not a sign-in protocol and an access token should not be treated as proof of a user’s identity.
As an Amazon Associate I earn from qualifying purchases.
OpenID Connect builds on OAuth 2.0 to authenticate an end user. Its central addition is the ID token, which carries claims about the authentication event and may contain other requested claims. The OpenID Foundation’s OpenID Connect Core 1.0 incorporating errata set 2 defines these token roles and the validation requirements.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minute| Artifact | Purpose | How the client uses it |
|---|---|---|
| ID token | Communicates an OIDC authentication event and identity claims to the relying party. | Validate it before relying on its claims. Do not use it as an API credential. |
| Access token | Grants access to a protected resource, subject to its scope and the resource server’s rules. | Present it to the intended resource, such as an API or the OIDC UserInfo endpoint. |
| UserInfo response | Returns End-User claims from a protected resource. | Call the HTTPS UserInfo endpoint with an access token when additional claims are needed. |
In OIDC, the application receiving and validating the ID token is the relying party. The API or other protected resource is a different recipient: it receives an access token, not an ID token.
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
How do I implement OAuth login securely?
Use authorization code flow for a redirect-based interaction. The browser receives an authorization code, which the client exchanges at the token endpoint; the access token is not issued in the authorization response. RFC 9700, the Internet Engineering Task Force’s January 2025 Best Current Practice for OAuth 2.0 Security, recommends code flow over implicit access-token issuance in the authorization response.
- Identify the client and its trust boundaries. A public client cannot safely keep a credential secret, while a confidential client can protect credentials in its server-side environment. Public clients must use PKCE under RFC 9700; confidential clients are also recommended to use it. Where feasible, authorization servers should authenticate clients. RFC 9700 recommends asymmetric approaches such as mutual TLS or signed JWT client authentication, which avoid requiring the server to keep a sensitive shared secret.
- Start a fresh authorization transaction. Generate a new, unpredictable PKCE verifier for each transaction. Derive its
S256challenge and include that challenge in the authorization request. Keep the verifier bound to the initiating client and user agent, then send it with the authorization code to the token endpoint. Do not reuse a verifier, challenge, or nonce across transactions. - Bind the response to the request. Use a transaction-bound CSRF defense. RFC 9700 allows a client to rely on PKCE for this purpose only when it has ensured the authorization server supports PKCE. In OIDC, a nonce provides CSRF protection; otherwise use a one-time
statevalue securely bound to the user-agent session. Ifstatecontains application data whose integrity matters, protect it against tampering and swapping. - Exchange the code and validate the result. Send the code and its transaction’s PKCE verifier to the token endpoint. The authorization server must verify the verifier when a challenge was supplied and must not accept a verifier as a substitute for a challenge that was never supplied. Validate any ID token before using its claims, as described below.
RFC 9700 states: “Authorization servers MUST support PKCE [RFC7636].” For implementation, the important client-side practice is to send an S256 challenge and retain the matching verifier securely for that single transaction.
Rank #2
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Do I need PKCE for a web app?
Yes for public clients, and it is recommended for confidential clients too. “Web app” alone does not determine the client category: the relevant question is whether the application can keep a credential confidential. A browser-based application cannot reliably protect a shared secret; a server-side application may be able to. PKCE adds a transaction-specific proof to the code exchange in either case.
Use the authorization code flow with PKCE rather than choosing implicit flow simply because the app runs in a browser. RFC 9700 advises against implicit grant and other response types that issue access tokens in the authorization response unless the associated leakage and injection risks are mitigated. Provider-specific registration settings and supported authentication methods vary, so verify those details for the authorization server you integrate.
Rank #3
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
How should I protect redirect URIs and callbacks?
Require an exact redirect URI match
Register the callback URI and require exact string matching between the registered value and the URI in an authorization request. The specified exception is for native applications using localhost redirects: an authorization server may allow the localhost port to differ. Do not generalize that exception to other redirect URIs.
A callback is a security boundary because it receives the authorization response. Avoid open redirectors that accept an arbitrary destination from a query parameter and forward the browser there; such a redirect can expose authorization codes or tokens.
Rank #4
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Defend clients that use multiple authorization servers
A client communicating with more than one authorization server must guard against mix-up attacks, in which a response from one server could be mistaken for a response from another. RFC 9700 recommends checking the authorization response’s iss parameter or another suitable issuer value in the response. If issuer identification in the response is unavailable, distinct redirect URIs for the different authorization servers are an alternative.
How do I validate an OpenID Connect ID token?
Do not trust identity claims just because a token can be decoded as a JWT. Before using them, apply the OpenID Connect Core checks that establish who issued the token, which client it was issued for, and whether it is currently valid.
Best Value
- A FIDO security key with PUF technology provides a unique, hardware-rooted trust anchor that resists tampering and cyber attacks, offering stronger security than conventional designs.
- FIDO2 Certified Protection – Enjoy phishing-resistant security with FIDO2 certification, ensuring top-tier account safety across Windows, macOS, Linux, iOS iOS, Android and more.
- Easy to use & Portable – Designed with a compact USB-C interface, Clife key fits easily on your keychain for secure access anywhere. Simply plug in and authenticate with ease.
- Universal Compatibility – Works seamlessly with hundreds of FIDO2/U2F compliant services, including popular cloud, email, and social platforms.
- Backup recommended – To ensure continuous access, register a backup Clife security key as a spare in case your primary key is lost.
- Issuer: confirm the token’s issuer is the expected issuer for the transaction.
- Audience: confirm the audience includes this client’s registered
client_id. Apply the specification’s additional checks for multiple audiences and the authorized party where applicable. - Signature: verify the signature according to the issuer’s applicable OIDC configuration and signing keys. A decoded payload is not a verified token.
- Expiration: ensure the token has not expired.
- Nonce: if the authorization request included a nonce, require the matching nonce claim in the ID token.
Only use claims suitable for the relying party’s purpose. OIDC defines sub as a locally unique, never-reassigned identifier within its issuer. It is not necessarily globally unique across different issuers, so an application handling identities from multiple providers should not treat sub alone as a cross-provider identifier.
When should I call the UserInfo endpoint?
Call UserInfo only when the application needs additional End-User claims beyond those it should use from the validated ID token. UserInfo is a separate OAuth protected resource, not a step that replaces ID-token validation. Send an access token to the issuer’s HTTPS UserInfo endpoint, and use the returned claims according to the endpoint’s and application’s trust requirements.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
