Hi! I am implementing the authorization code flow and I am curious about the nonce parameter. Is it necessary? I have implemented a check with the state parameter, but the documentation seems to be inconsistent about if the nonce parameter is also required. Is it insecure to not do anything with no…

@alina-dc Hi, nonce is a value that is returned in the ID token. It is used to associate a client session with an ID token and to mitigate replay attacks. If you are using the implicit flow, the ‘nonce’ parameter is required in the initial ‘/authorize’ request, and the ID token includes a ‘nonce’ cl…

Hi! Thanks so much for your fast and clear response. Thanks for confirming–since I’m using the authorization code flow, I won’t do anything with a ‘nonce’ value.

I’m looking over the documentation and I realize that given your response, the API documentation for the /authorize endpoint ( https://developer.okta.com/docs/reference/api/oidc/#authorize ) may be inaccurate. The request parameters chart says that the nonce parameter is required, but that doesn’t see…

Thank you for pointing this out @alina-dc ! We will update our API doc to reflect that nonce is NOT required for response_type = code according to OIDC Spec 3.1.2.1. Authentication Request .

Hello - I’m using the Okta Auth JavaScript SDK : given that nonce attribute is not required for the Authorization Code Flow (responseType: 'code') is there a way to remove nonce from the initial outgoing request to /oauth2/v1/authorize? I have impression that Okta SDK automatically adds the nonce att…

Authorization code flow: is the nonce parameter necessary?

Questions

sigama November 30, 2021, 5:46pm 7

Hi @acicchit! Thanks for bringing this up - I replied to your same post here Authorization Code Flow - Disable or Read `nonce` with JavaScript SDK - #2 by sigama.

Post		Replies	Views
Authorization Code Flow - Disable or Read `nonce` with JavaScript SDK Questions	5	5625	December 1, 2021
Authorization Code Flow : validating JWT Token, nonce required Questions	5	5234	April 28, 2021
Authorization code flow- id_token added unnecessarily in request url OAuth/OIDC	6	2220	December 27, 2022
Okta initiated Authorization Code Flow requires selecting Implicit Grant OAuth/OIDC	12	3949	May 13, 2022
Nonce is invalid in id_token OAuth/OIDC	1	1208	April 11, 2024

Authorization code flow: is the nonce parameter necessary?

Related topics