OAuth and OIDC

  1. JSON Web Tokens in OAuth and OIDC
    1. JWT Fundamentals
      1. Purpose in OAuth/OIDC
        1. Self-Contained Tokens
          1. Stateless Validation
          2. JWT Structure
            1. Three-Part Format
              1. Base64URL Encoding
                1. Dot Separation
                2. JWT Header
                  1. Algorithm Specification
                    1. Token Type Declaration
                      1. Key Identification
                      2. JWT Payload
                        1. Claims Structure
                          1. Registered Claims
                            1. Issuer
                              1. Subject
                                1. Audience
                                  1. Expiration Time
                                    1. Not Before
                                      1. Issued At
                                        1. JWT ID
                                        2. Public Claims
                                          1. Private Claims
                                          2. JWT Signature
                                            1. Purpose and Function
                                              1. Signing Process
                                                1. Integrity Protection
                                                  1. Tampering Detection
                                                  2. Signing Algorithms
                                                    1. Symmetric Algorithms
                                                      1. HMAC with SHA-256
                                                        1. Key Management
                                                          1. Use Cases
                                                          2. Asymmetric Algorithms
                                                            1. RSA with SHA-256
                                                              1. ECDSA with SHA-256
                                                                1. Public Key Infrastructure
                                                                  1. Key Distribution
                                                                2. JWT Validation Process
                                                                  1. Signature Verification
                                                                    1. Claim Validation
                                                                      1. Time-Based Checks
                                                                        1. Audience Verification
                                                                        2. JWT Security Considerations
                                                                          1. Algorithm Confusion Attacks
                                                                            1. Key Management
                                                                              1. Token Lifetime
                                                                                1. Sensitive Information Exposure

                                                                              Previous

                                                                              7. OpenID Connect Identity Layer

                                                                              Go to top

                                                                              Next

                                                                              9. Security Considerations and Threats