3 ms·
Wouldn't an app normally at least need to look at some claims in the jwt (email for example)? Otherwise, how do you identify the user?
by osigurdson 2y ago
Wouldn't an app normally at least need to look at some claims in the jwt (email for example)? Otherwise, how do you identify the user?
- hnbad 2y agoBy using the token to access the userinfo endpoint of the OIDC API? Yes, some info is encoded in the token already but that's why OIDC includes that endpoint unlike OAuth2 (which was authorization only even if it was often used for authentication).