OIDC
OpenID Connect
An identity layer on OAuth 2.0: the provider issues an ID token telling the client who signed in, when and how. An access token is for calling APIs and does not prove identity to the client (OpenID Connect Core 1.0).
- Defined in
- OpenID Connect Core 1.0
Covered in
OAuth 2.0 and OpenID Connect login: authorization code with PKCE
Implement OAuth 2.0 and OpenID Connect login with the authorization code flow and PKCE, keep each transaction bound to its browser, and block redirect, mix-up, code-injection and token-theft attacks.
Defend OAuth and OIDC against redirect and token attacks
Apply RFC 9700 and RFC 10017: exact redirect matching, PKCE with downgrade protection, state and iss binding, refresh-token rotation, sender-constrained tokens, and a backend-for-frontend so browser tokens cannot be stolen.
Harden GitHub Actions against workflow and supply-chain attacks
Close the paths that give untrusted pull-request code secrets or a write token: pass context through env, keep pull_request_target away from fork code, pin actions to commit SHAs, scope GITHUB_TOKEN and OIDC, and treat artifacts as data.
Case study: the CircleCI security incident (January 2023)
How a session stolen from one engineer's laptop reached CircleCI's production systems and customers' stored secrets in 2023, and what platform operators and CI users should change.
Protect package publication and the update channel
Constrain release identities, verify what consumers receive, and prepare for publisher or update-key compromise.
Review cloud permissions and role trust together
Distinguish who can obtain a cloud identity from what that identity can do, then test the effective access path.
All 10 pages that cover OIDC in the library
Practice: Actions injection lab: Flag GitHub Actions expression injection · OAuth redirect and PKCE lab: Match redirect URIs and verify PKCE · IAM trust policy lab: Evaluate a role trust policy against the confused deputy · Local project: Repair a security pipeline for GitHub Actions and GitLab CI