OAuth vs OIDC: what is the difference?
Try code in the playgroundUnderstand the concept
OAuth is a framework for delegated access, allowing a client to act with limited permission on protected resources. OpenID Connect (OIDC) adds a standard identity layer for user login on top of OAuth. The authorization code flow separates browser redirects from the token exchange and commonly uses PKCE to protect that exchange.
Important ideas
-
OAuth allows an app to access resources with permission.
-
OIDC adds identity information for login on top of OAuth.
-
ID tokens identify the login user; access tokens are for the intended API.
-
Request only needed scopes and validate the intended issuer and audience rather than trusting any correctly signed token.
Can you explain it without the notes?
OAuth vs OIDC: what is the difference?
Use your own words. Explain an example and one limitation before checking the explanation.
Check your explanation
OAuth is a framework for delegated access, allowing a client to act with limited permission on protected resources. OpenID Connect (OIDC) adds a standard identity layer for user login on top of OAuth. The authorization code flow separates browser redirects from the token exchange and commonly uses PKCE to protect that exchange.
Turn this concept into a clear answer.
- Use an ID token to establish the client's login identity and an access token intended for the resource API to call that API.
Keep connecting the ideas.
Next lesson: How do I prevent injection, XSS, CSRF and SSRF?Adapted from 02_NODE_EXPRESS_HTTP.md · “OAuth vs OIDC: what is the difference?”. Examples are study fragments; framework behavior can depend on your version.