Auth Internals & OAuth2 — Series 2

Preview — 3 of 10 questions

A team sends the id_token to their API as the bearer credential. What is wrong with that?

javascript

{ "access_token": "eyJ...", "id_token": "eyJ...", "token_type": "Bearer" }

ANothing — both are signed JWTs from the same issuer, so either works

BThe id_token is opaque and cannot be verified by a resource server

CThe id_token is an OIDC artefact whose audience is the client, asserting who the user is and how they authenticated; the access_token is the credential whose audience is the API and whose scopes describe what may be done — accepting an ID token means accepting a token that was never scoped or intended for that API

DThe id_token lacks a signature, so it cannot be trusted

What is state for?

javascript

GET https://auth.example.com/authorize
  ?response_type=code&client_id=...&redirect_uri=...&state=9f2c...

AIt is an unguessable value the client generates, stores against the user's session, and compares when the callback arrives — proving the callback belongs to an authorisation request this user actually initiated, which is what prevents an attacker from injecting their own authorisation code

BIt carries the user's current page so the client can restore it after login

CIt encodes the requested scopes in compressed form

DIt is an opaque identifier the authorisation server uses to look up the session

What does verifying nonce protect against, and how does it differ from state?

javascript

/authorize?...&nonce=b71e...   →   id_token payload: { "nonce": "b71e...", ... }

ANothing beyond what state already covers; the two are redundant

BIt binds the token to the client's IP address

CIt guarantees the token is used only once, by recording it server-side

Dstate binds the callback to the request, while nonce binds the issued ID token to it — so a token captured from an earlier or unrelated flow cannot be replayed into this one, which matters where tokens reach the client directly

Answer all 10 questions (7 more), see explanations for every answer, and track your score.