Is ID token secure?
The ID Token is a security token that contains Claims about the Authentication of an End-User by an Authorization Server when using a Client, and potentially other requested Claims.
What can you do with ID tokens?
Once a user logs in, use the ID token to gather information such as name and email address, which you can then use to auto-generate and send a personalized welcome email. ID Tokens should never be used to obtain direct access to APIs or to make authorization decisions.
How long do Google ID tokens last?
Firebase ID tokens are short lived and last for an hour; the refresh token can be used to retrieve new ID tokens. Refresh tokens expire only when one of the following occurs: The user is deleted. The user is disabled.
What happens when ID token expires?
When the access token expires, the application will be forced to make the user sign in again, so that you as the service know the user is continually involved in re-authorizing the application.
How to use OpenID Connect with access token?
Thus, the user needs to log-in on the web-site using authorization code flow of OpenId Connect offered by KeyCloak and use the access token given by the token endpoint. This request with the access token can be either sent by browser or by one of the back-end services delivering the current web-site.
What kind of protocol is OpenID Connect based on?
Based on the OAuth 2.0 protocol: The ID token is obtained via a standard OAuth 2.0 flow, with support for web applications as well as native / mobile apps. OAuth 2.0 also means having one protocol for authentication and authorisation (obtaining access tokens).
Where does authentication take place in OpenID Connect?
Authentication must take place at the identity provider, where the user’s session or credentials will be checked. For that a trusted agent is required, and this role is usually performed by the web browser. A browser popup is the preferred way for a web application to redirect the user to the IdP.
Can a access token be sent by a browser?
This request with the access token can be either sent by browser or by one of the back-end services delivering the current web-site. Thus, we can either do a a client-side integration or server-side integration with the REST API. Unfortunately, the server-side integration is not that feasible due to the complex structure of back-end systems.