OpenID Connect (OIDC)
: An identity layer built on top of OAuth 2.0 that provides authentication (verifying who a user is) in addition to OAuth’s authorization (what they can access). OIDC adds an ID token (a JWT containing user identity claims) to the OAuth flow, enabling standardized single sign-on (SSO) across applications.
Why It Matters for AI-Coded Apps
AI-generated authentication code often confuses OAuth 2.0 (authorization) with OIDC (authentication) or implements custom authentication when OIDC should be used. LLMs generate auth flows that skip ID token validation, accept tokens without verifying the issuer, or store sensitive claims insecurely.
Real-World Example
A proper OIDC flow: the app redirects to Google’s authorization endpoint, the user authenticates, Google returns an authorization code, the app exchanges it for an ID token containing {sub: '12345', email: 'user@gmail.com', iss: 'accounts.google.com'}. The app validates the token signature, issuer, and audience before creating a session.
How to Detect and Prevent It
Use established OIDC libraries (next-auth, passport-openidconnect, authlib) instead of implementing the protocol manually. Always validate the ID token signature, issuer (iss), audience (aud), and expiration (exp). Use the authorization code flow with PKCE for public clients. Never use the implicit flow for new applications.
Frequently Asked Questions
What is the difference between OAuth 2.0 and OIDC?
OAuth 2.0 handles authorization (granting access to resources). OIDC handles authentication (proving identity). OAuth gives you an access token to call APIs. OIDC gives you an ID token that tells you who the user is. OIDC is built on top of OAuth 2.0 and adds the identity layer.
Should I implement OIDC myself or use a library?
Always use a library or authentication service (Auth0, Clerk, Supabase Auth). OIDC has many security requirements (nonce validation, token verification, PKCE) that are easy to implement incorrectly. AI-generated custom OIDC implementations almost always have security gaps.
What is PKCE and why does it matter?
PKCE (Proof Key for Code Exchange) prevents authorization code interception attacks. The client generates a random code_verifier and sends its hash (code_challenge) with the authorization request. When exchanging the code, the client proves possession of the original verifier. PKCE is required for SPAs and mobile apps.
Scan your app for security issues automatically
Vibe Eval checks for 200+ vulnerabilities in AI-generated code.
Try Vibe Eval