OpenID Connect quiz

Test your OpenID Connect knowledge with a free interactive quiz — 20 questions with answers and explanations. No signup needed to play.

What is the fundamental difference between an OIDC ID token and an OAuth2 access token?

1. What is the fundamental difference between an OIDC ID token and an OAuth2 access token?
2. What does the `sub` claim represent in an OIDC ID token?
3. What does the `aud` (audience) claim in an ID token protect against if properly validated?
4. What does the OIDC UserInfo endpoint provide?
5. What is the "discovery document" (`.well-known/openid-configuration`) in OIDC used for?
6. What is the "Authorization Code" flow in OIDC/OAuth2, and why is it generally recommended for server-side web applications?
7. Why must a client validate an ID token's signature and claims (issuer, audience, expiration) rather than just trusting its contents blindly?
8. What is an OIDC "ID token"?
9. What is the purpose of a "refresh token" in the OAuth2/OIDC ecosystem?
10. Why do modern mobile and single-page applications typically favor OIDC/OAuth2 with PKCE over older enterprise SSO protocols like SAML?
11. Why is it considered insecure for a client application to use the access token itself (instead of the ID token) to determine a user's identity?
12. What is the general purpose of "logout"/session-termination mechanisms in OIDC (e.g. RP-Initiated Logout)?

More quizzes