Hi! I am implementing the authorization code flow and I am curious about the nonce parameter. Is it necessary? I have implemented a check with the state parameter, but the documentation seems to be inconsistent about if the nonce parameter is also required. Is it insecure to not do anything with no…

@alina-dc Hi, nonce is a value that is returned in the ID token. It is used to associate a client session with an ID token and to mitigate replay attacks. If you are using the implicit flow, the ‘nonce’ parameter is required in the initial ‘/authorize’ request, and the ID token includes a ‘nonce’ cl…

Authorization code flow: is the nonce parameter necessary?

Questions

sigama November 30, 2021, 5:46pm 7

Hi @acicchit! Thanks for bringing this up - I replied to your same post here Authorization Code Flow - Disable or Read `nonce` with JavaScript SDK - #2 by sigama.

Post		Replies	Views
Authorization Code Flow : validating JWT Token, nonce required Questions	6	4939	April 28, 2021
Authorization Code Flow - Disable or Read `nonce` with JavaScript SDK Questions	6	5105	February 8, 2024
Problems with Okta spring boot tutorial (possible bug in Okta API, and how to change redirect uri) OAuth/OIDC	7	7445	September 26, 2018
Okta initiated Authorization Code Flow requires selecting Implicit Grant OAuth/OIDC	13	3514	May 13, 2022
PKCE flow Authorize then Token Questions	11	4464	February 8, 2024

Authorization code flow: is the nonce parameter necessary?

Related topics