oidc-id-token

To generate a compliant OIDC ID Token, include the iss, sub, aud, exp, and iat required claims, handle nonce and auth_time, and sign the token using RS256 with a proper JOSE header containing the alg and kid fields.

Validating an OIDC ID Token involves checking the issuer, audience, expiration, and nonce matching. It also requires verifying the JOSE header and confirming proper hash calculations for at_hash and c_hash per OpenID Connect Core.

You need to include at_hash and c_hash in an ID Token when handling hybrid or authorization code flows. These conditional claims tie the ID Token to the access token and authorization code to prevent token substitution attacks.

Yes, Basic OP certification requires ID Tokens to be signed using the RS256 algorithm. The token must include a JOSE header specifying the alg as RS256 and a kid for key identification.

Nonce handling for OpenID Connect ID Tokens requires generating a nonce during the authentication request and matching it against the nonce claim returned in the ID Token. This prevents replay attacks during the flow.