topic
Verified 2026-09-18OAuth, OIDC, and Bearer Token Handling
OAuth delegates authorization while OIDC adds an identity layer; bearer tokens grant access to whoever possesses them.
Validate token issuer, audience, signature, expiry, scope, and transport. Use authorization code with PKCE for browser-based clients, keep access tokens out of URLs and logs, and distinguish an identity assertion from an API access token.
httpsecurityauthoauthapi
Reference (http)
Authorization: Bearer eyJ... WWW-Authenticate: Bearer realm="api", error="insufficient_scope"
Validate token issuer, audience, signature, expiry, scope, and transport. Use authorization code with PKCE for browser-based clients, keep access tokens out of URLs and logs, and distinguish an identity assertion from an API access token.
Common mistakes
- Accepting any validly signed token without checking issuer or audience, putting tokens in query strings, or treating an ID token as an API access token.