Web Security · Senior · Question 45 of 75

What does the OIDC `nonce` parameter protect against?

1CSRF on the API endpoints
2Brute force on the login form
✓Correct answer: Replay of an ID token: the client checks that the token's nonce claim matches the value it sent

Explanation

The nonce binds the ID token to this particular authentication request and browser session.

Further reading

Test yourself

Take the Web Security · Senior quiz: questions and options are shuffled, and you get a review of your mistakes at the end.