Clients : Implicit Javascript Client

[pksorensen]

    <!-- for JWS -->
    <script src="http://crypto-js.googlecode.com/svn/tags/3.1.2/build/components/core.js"></script>
    <script src="http://crypto-js.googlecode.com/svn/tags/3.1.2/build/components/sha1.js"></script>
    <script src="http://crypto-js.googlecode.com/svn/tags/3.1.2/build/components/sha256.js"></script>
    <script src="http://crypto-js.googlecode.com/svn/tags/3.1.2/build/components/x64-core.js"></script>
    <script src="http://crypto-js.googlecode.com/svn/tags/3.1.2/build/components/sha512.js"></script>

    <script src="http://kjur.github.io/jsrsasign/ext/base64.js"></script>
    <script src="http://kjur.github.io/jsrsasign/ext/jsbn.js"></script>
    <script src="http://kjur.github.io/jsrsasign/ext/jsbn2.js"></script>
    <script src="http://kjur.github.io/jsrsasign/ext/rsa.js"></script>
    <script src="http://kjur.github.io/jsrsasign/ext/rsa2.js"></script>
    <script src="http://kjur.github.io/jsrsasign/rsapem-1.1.js"></script>
    <script src="http://kjur.github.io/jsrsasign/rsasign-1.2.min.js"></script>
    <script src="http://kjur.github.io/jsrsasign/asn1hex-1.1.js"></script>
    <script src="http://kjur.github.io/jsrsasign/x509-1.1.js"></script>
    <script src="http://kjur.github.io/jsrsasign/crypto-1.1.js"></script>
    <script src="http://kjur.github.io/jsrsasign/base64x-1.1.js"></script>

    <script src="Scripts/json-sans-eval.js"></script>
    <script src="Scripts/jws-3.0.js"></script>
    <!-- /for JWS -->

Possible that you guys could give a short comment on all above scripts?

Is it just the the purpose of decoding, showing content of the tokens in the browser?

In real world applications would people do stuff like that? Is the more used approach not to use the token to ask the user endpoint to get the claims / profile.

I am wondering if you have a good usecase where you have used this in real world applications to decode the jwt tokens on the client.

[brockallen]

We will eventually provide some JS to validate id tokens and this is a JS library we are using for now to do that (since it already implemented all the JWT validation).

[leastprivilege]

The OIDC spec requires that the first thing you do in your client app is to validate the identity token. This sample will eventually show how this works in JS. But we are done yet.

[pksorensen]

I figured that it was not done, some other comment/task here indicated it.

Makes sense. So validate the identity token.

The reason why I might not have seen this before when working with oauth2, could it be normal behavior that you just request a token and pass it on to the resource api again and its not important to validate the token if its not used in the client but only to access remote resources.

[leastprivilege]

Right - OAuth2 is not about authentication ;) But in OIDC the client is actually the consumer of the identity token.

[brockallen]

Dup of this: #13