OpenID Connect quiz

Test your OpenID Connect knowledge with a free interactive quiz — 20 questions with answers and explanations. No signup needed to play.

What is the role of a JWKS (JSON Web Key Set) endpoint in an OIDC provider's configuration?

1. What is the role of a JWKS (JSON Web Key Set) endpoint in an OIDC provider's configuration?
2. What is the "discovery document" (`.well-known/openid-configuration`) in OIDC used for?
3. Why is it considered insecure for a client application to use the access token itself (instead of the ID token) to determine a user's identity?
4. What does the `aud` (audience) claim in an ID token protect against if properly validated?
5. Why must a client validate an ID token's signature and claims (issuer, audience, expiration) rather than just trusting its contents blindly?
6. What is OpenID Connect (OIDC)?
7. What does the OIDC UserInfo endpoint provide?
8. What is the key relationship between OAuth 2.0 and OpenID Connect?
9. What is an OIDC "scope," and what does the required `openid` scope specifically trigger?
10. What is a "claim" in an OIDC ID token?
11. What is the purpose of a "refresh token" in the OAuth2/OIDC ecosystem?
12. Why has the OAuth2/OIDC "Implicit flow" fallen out of favor and been deprecated in current best-practice guidance?

More quizzes