Web Security · Middle · Question 56 of 75

"Sign in with Google" returns an ID token to your backend. What must the backend check?

✓Correct answer: The signature using Google's published keys, plus iss, aud (your client ID), exp and the nonce if used
2Only that the email claim looks valid
3Nothing, because the token came over HTTPS

Explanation

Without aud checking, a token issued for another app could log someone into yours.

Further reading

Test yourself

Take the Web Security · Middle quiz: questions and options are shuffled, and you get a review of your mistakes at the end.