ID Token
A JWT issued by an OpenID Connect provider that conveys authentication claims about the user. Unlike access tokens, ID tokens are intended for the client, not for resource servers. The client validates the signature, issuer, audience, and expiration before trusting the claims.
The single most common OIDC implementation bug is sending an ID token to an API and treating it as authorization. ID tokens are for the client: audience-restricted, meant to be read once at sign-in, and not designed to be presented to resource servers. Validate signature, issuer, audience, expiry, and nonce, then derive your own session. Use an access token for API calls.
See also: OpenID Connect, access token, claims, validate a JWT recipe
Related on Start with Identity
- GlossaryJWKS
JSON Web Key Set. A published set of public keys an issuer uses to sign tokens, letting relying parties verify JWT signatures and handle key rotation. The JWKS
- GlossaryRefresh Token
A longer-lived credential used to obtain new access tokens without re-authenticating the user. Refresh tokens should be one-time-use (rotated on each exchange)
- GlossaryIdentity Federation
A trust relationship between identity providers and service providers that lets users authenticate once at their home IdP and access applications at the other p
- CVESharePoint JWT validation chain, forge a token and become any user
Four weaknesses across two SharePoint JWT token handlers chain into an unauthenticated authentication bypass. Rapid7 published a proof of concept in August 2026
- CVEAuth0 node-jws HS256 verification bypass via secret lookup
node-jws before 3.2.3 / 4.0.1 can accept an HS256 JWT when the caller looks up the secret from attacker-controlled input. Medium on paper, but it is a signature
- CVEDrupal Simple OAuth/OIDC auth bypass via an alternate path
Drupal Simple OAuth / OIDC 6.0.0 through 6.0.6 allowed authentication to be skipped on an alternate path. Patched in 6.0.7.