| name | oidc-id-token-validation |
| description | Authorized validation and assessment of OpenID Connect ID tokens: iss, aud, exp/nbf, nonce, signature via JWKS, and azp/at_hash checks. Use when an RP or API accepts id_token JWTs after OIDC login, hybrid flow, or token exchange and you must verify claim binding or prove missing validation. |
OIDC ID Token Validation
Focused methodology for OpenID Connect id_token acceptance: issuer, audience,
lifetime, nonce binding, and signature trust. Complements full OAuth flow testing
and generic JWT crypto abuse.
When To Use
| Situation | Direction |
|---|
RP/client validates (or should validate) an OIDC id_token | This skill |
Claims under review: iss, aud, exp, nbf, iat, nonce, azp, at_hash | This skill |
Hybrid / residual implicit / code + id_token response types | This skill (token checks) |
Full OAuth: redirect_uri, state, PKCE, code leak, mix-up | oauth-oidc-misconfiguration |
| Resource-server access JWT: alg none, kid/jku, HS confusion | api-auth-and-jwt-abuse |
| Access + refresh lifecycle / rotation / reuse | jwt-refresh-token-patterns |
| SAML assertions (not OIDC JWT) | saml-sso-basics |
| No authorization for live auth surfaces | Do not test actively |
Keywords: id_token, OIDC Core, JWKS, nonce, audience, issuer, clock skew, azp.
Scope And Authorization
- Owned apps, labs, CTFs, or named engagement targets only. Prefer staging IdPs and test users.
- Do not attack third-party IdP production beyond the client/RP integration and any IdP/tenant the program names.
- Treat
id_token, access/refresh tokens, and codes as credentials: redact; store offline; rotate after production demos.
- Prefer non-destructive accept/reject evidence pairs. No mass login or lockout of real users.
- Assessment methodology only — not a guide to weaponize production IdPs at scale.
Workflow
1. Map who validates what
| Field | Capture |
|---|
| Roles | IdP/AS, RP (client), optional resource server |
| Where checked | SPA library, BFF, mobile SDK, API gateway |
| Discovery | /.well-known/openid-configuration → issuer, jwks_uri, algs |
Expected aud | Registered client_id(s) |
| Flow | auth code (+ PKCE), hybrid, legacy implicit |
| Nonce storage | Server session, cookie, SPA memory |
Decode payload offline only on tokens you may capture; do not publish live signatures.
2. Signature and key trust (baseline)
Confirm the verifier: (1) keys from trusted jwks_uri or pinned material—not attacker jku/jwk alone; (2) server-side alg allowlist (e.g. RS256/ES256), reject none; (3) kid maps to pinned JWKS. Deep alg/kid/jku forgery → api-auth-and-jwt-abuse. Stay here for OIDC claim semantics.
3. iss (issuer)
| Probe | Expected secure behavior |
|---|
Omit iss | Reject |
| Wrong issuer (other IdP, http/https, trailing slash) | Reject |
Exact discovery issuer | Accept only configured value(s) |
| Multi-tenant templates | Only registered tenants; no open suffix you control |
Accepting a foreign issuer → mix-up / cross-IdP risk (pair with oauth-oidc-misconfiguration).
4. aud (audience) and azp
| Probe | Expected secure behavior |
|---|
Missing aud | Reject |
| Other client_id / API resource | Reject for this RP |
| Array with foreign client | Still require this client_id |
Multi-aud without azp | Prefer require azp = this client |
Baseline: aud must include this RP’s client_id exactly—not a loose parent-string match.
5. exp, nbf, iat (lifetime)
| Probe | Secure behavior |
|---|
After exp (or lab-signed expired) | Reject outside small skew |
Future nbf | Reject until valid |
Missing / unbounded exp | Require exp; cap max lifetime |
| Skew | Document ±1–5 min typical; avoid unbounded |
Replay a prior id_token after logout/exp when possible; one accept/reject pair is enough.
6. nonce (session binding)
When authorize included nonce (required for browser implicit/hybrid id_token; recommended for code flow at RP):
| Probe | Expected secure behavior |
|---|
Omit / empty / wrong nonce | Reject if nonce was sent |
| Replay token from flow A into session B | Reject |
Client never sent nonce but accepts any | Document residual CSRF/replay risk |
RP must compare id_token.nonce to the value it generated and stored for that session.
7. Related claims and remediation
at_hash / c_hash: verify when access token or code is returned with id_token.auth_time / max_age: enforce re-auth freshness if requested.acr / amr: not client-asserted MFA proof without IdP policy.- Remediation: pin JWKS + alg allowlist; require exact
iss and aud (this client_id); enforce exp/nbf + skew; bind nonce to login session; prefer auth code + PKCE; validate azp on multi-aud; do not treat raw id_token as long-lived API session → jwt-refresh-token-patterns; implement per code-quality-standards (never log full tokens).
Routing
| Need | Skill |
|---|
id_token iss/aud/exp/nonce validation | This skill |
| OAuth flow: redirect_uri, state, PKCE, code, mix-up | oauth-oidc-misconfiguration |
| JWT alg/kid/jku/none forgery | api-auth-and-jwt-abuse |
| Access + refresh rotation, reuse, storage | jwt-refresh-token-patterns |
| PKCE public-client checklist | oauth-pkce-checklist |
| Multi-vector ATO including OIDC | account-takeover-methodology |
| Secure RP implementation | code-quality-standards |
Selection: OIDC id_token claim acceptance → this skill. Wire protocol → oauth-oidc-misconfiguration. Crypto/alg → api-auth-and-jwt-abuse. Refresh lifecycle → jwt-refresh-token-patterns.
Output Checklist
