3 ms·

Ah, gotcha. That sounds like token introspection basically, which is a (budding?) standard, not really userinfo.

• lvh 7y ago
  Unless my memory is failing me, in the Google case it was really /userinfo (as in the OIDC Core UserInfo endpoint) and not token introspection (a "post-auth" endpoint taking a token, not a "pre-auth" one you pass a JWT to). Though I agree that from the perspective of a consumer the two are basically just as good :-)
  • hirsin 7y ago
    I would think a "Pre-auth" endpoint that can be called for user information is not what consumers want...
    • lvh 7y ago
      I mean pre-auth in that you pass it a JWT with a shared credential that it parses for you, as opposed to an explicit auth'd credential.