Identity & Security · 9 min read
IAM Chapter 5, Part 4: Bound to This Login
The four checks prove the token is real. They never prove it is yours. Nonce vs state, claims in the token vs UserInfo, why there is never only one session, and what an OIDC migration from SAML really costs.
- iam
- oidc
- openid-connect
Read post →