You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Current NJS implementation disregard the access_token that is being sent by the IdP and only uses the id_token to get stored in the NGINX Plus K/V store.
Token Recommandation
When Using
Do
Don't
ID Token
- Assume the user is authenticated
- Call an API
- Get user profile data
- Check if the client is allowed to access something.
Access Token
- Call an API
- Inspect its content on the client
- Check if the client is allowed to access something
Background:
Current NJS implementation disregard the
access_token
that is being sent by the IdP and only uses theid_token
to get stored in the NGINX Plus K/V store.Token Recommandation
courtesy: ID Token and Access Token: What's the Difference?
Acceptance Criteria:
access_token
sent by the IdP.access_token
in the k/v store as same as we storeid_token
andrefresh_token
Compatibility:
The text was updated successfully, but these errors were encountered: