CODEWITHSUNDEEP
authenticationoauth-2.0azure-active-directory
Ranieri Mazili
Ranieri Mazili

Reputation: 833

What's the nonce function on Oauth authentication process?

I'm developing a software where the login process is done using Microsoft Azure AD with Oauth2. The nonce number is optional on this process and after a successful login I receive a token that's valid for one hour.

I couldn't understand the function of nonce on this process and I'm not using it. Is my authentication less secure because of this? What's the benefits of add a nonce number on this process?

Upvotes: 5

Views: 10426

Answers (1)

Kavindu Dodanduwa
Kavindu Dodanduwa

Reputation: 13059

Nonce binds client and token which prevents token replay attacks.

nonce - String value used to associate a Client session with an ID Token, and to mitigate replay attacks

Think about your token endpoint and receiving token response from authorization server. As the client, how could you validate ID token to be not replayed by a malicious party? This is what nonce serves.

You add this parameter in authorization request. And in the token response, you get ID token. When you validate the token, you verify nonce inside token (JWT claims).

More from this answer

Also, depending on the flow type, nonce can be a mandatory parameter. The implicit flow and hybrid flow mandate nonce value

Upvotes: 7

Related Questions