Getting Started with OAuth 2.0

Check ID Endpoint

The Check ID Endpoint exists to validate the id_token returned along with the OAuth 2.0 access_token by ensuring that it was intended for the correct client and is used by the client to begin an authenticated session. As described above, this check is required for the implicit flow for client-side applications (described in Chapter 3). If this check isn’t done correctly, the client becomes vulnerable to replay attacks.

Here’s an example Check ID endpoint request:

https://accounts.example.com/oauth2/tokeninfo?
  id_token=eyJhbGciOiJSUzI1NiJ9.eyJpc3MiOiJhY2NvdW50cy5nb29nbGUuY29tIiwiY...

And the response:

{
  "iss" : "https://accounts.example.com",
  "user_id" : "113487456102835830811",
  "aud" : "753560681145-2ik2j3snsvbs80ijdi8.apps.googleusercontent.com",
  "exp" : 1311281970
  "nonce" : 53f2495d7b435ac571
}

If the response is returned without a standard OAuth 2.0 error, the following checks need to be performed:

• Verify the aud value in the response is identical to the client_id used in the Authorization request.

• Verify that the nonce value in the response matches the value used in the Authorization request.

If this verification is completed successfully, the user_id is known to represent the unique identifier for the authenticated user, within the scope of the issuer (iss). If storing the identifier in a user database table and multiple identity providers are supported by your application, it is recommended that both values be stored upon account creation and queried upon each subsequent ...