Description
According to https://openid.net/specs/openid-connect-core-1_0.html#IDToken
ID Tokens MUST be signed
It works with many OIDC clients only because most of them also support OAuth2 in which the token is not signed.
Attachments
Issue Links
- is duplicated by
-
OIDC-17 Implement JWK endpoint
-
- Closed
-