Alur Kode Otorisasi dengan OIDC
Terapkan Alur Kode Otorisasi yang aman, yang diperluas dengan OIDC untuk mengembalikan Token ID bersama token akses.
Alur Kode Otorisasi dengan OIDC adalah pelajaran OAuth2 & OpenID Connect Deep Dive gratis di CoddyKit. Ini adalah pelajaran 1 dari 4. Kamu bisa membaca pelajaran lengkapnya di bawah secara gratis — lalu praktikkan langsung di browser dengan editor kode bawaan dan tutor AI 24/7. Ini adalah bagian dari jalur belajar OAuth2 & OpenID Connect Deep Dive, dan progresmu tersinkronisasi di web dan aplikasi CoddyKit. Kursus OAuth2 & OpenID Connect Deep Dive mencakup 4 pelajaran total.
Bagian dari pelajaran ini belum diterjemahkan dan ditampilkan dalam bahasa Inggris.
OIDC & Auth Code Flow Intro
Welcome! In this lesson, we'll combine the secure Authorization Code Flow from OAuth2 with OpenID Connect (OIDC). This allows an application to not only get permission to access resources (OAuth2) but also to verify the user's identity (OIDC).
Think of it as getting both a key to a safe and a valid ID card for the person holding the key, all in one go!
Requesting Identity with OIDC
When using the Authorization Code Flow with OIDC, your application (the Client) starts by sending an authorization request to the Authorization Server. This request is similar to OAuth2 but includes specific OIDC parameters.
response_type=code: Specifies we want an Authorization Code.scope=openid ...: Crucially, includes theopenidscope to signal an OIDC request.nonce: A unique string to prevent replay attacks (optional but recommended).
The Essential `openid` Scope
The openid scope is the magic flag that tells the Authorization Server you're performing an OpenID Connect request, not just a plain OAuth2 request.
Without openid in your request's scope, the Authorization Server will treat it as a standard OAuth2 flow and will not issue an ID Token.
You can combine openid with other standard OAuth2 scopes like profile, email, or custom scopes.
Beyond `openid`: More Scopes
While openid is mandatory, other OIDC-specific scopes allow you to request more user information:
profile: Access to default profile claims (name, family name, gender, picture, etc.).email: Access to the user's email address and verification status.address: Access to the user's postal address.phone: Access to the user's phone number and verification status.
These claims are then included in the ID Token or accessible via the UserInfo Endpoint.
User Consent & Code Grant
After your app sends the authorization request, the user is redirected to the Authorization Server. They log in (if needed) and are prompted to consent to your app's requested scopes.
If the user approves, the Authorization Server redirects the user back to your app's registered redirect URI, including the Authorization Code in the URL query parameters.
The Token Exchange
Now, your application (running on a server, for confidential clients) takes the received Authorization Code and exchanges it directly with the Authorization Server's token endpoint.
This is a back-channel request, meaning it happens directly between your server and the Authorization Server, not through the user's browser.
Crucially, this exchange now returns three important pieces of information:
- Access Token
- Refresh Token (if requested)
- ID Token
What is the ID Token?
The ID Token is a JSON Web Token (JWT) that contains claims about the authenticated user. It's signed by the Authorization Server, allowing your application to verify its authenticity.
Unlike the Access Token (which is for resource access), the ID Token is specifically for identity verification. It tells your application *who* the user is, not *what* they can do.
ID Token for Identity, Access Token for API
Once your application receives the tokens:
- ID Token: You can decode and validate the ID Token to confirm the user's identity and retrieve basic profile information (claims). This is often used for user login sessions.
- Access Token: This token is then used to make requests to protected Resource Servers (APIs) on behalf of the user, granting access to specific resources based on the requested scopes.
OIDC Auth Code Flow in Action
Here's a simplified conceptual look at the server-side token exchange. In a real application, you'd use an OIDC client library.
public class OidcClientExample {
public static void main(String[] args) {
// 1. User is redirected to Auth Server
// Example URL:
// https://auth.example.com/oauth/authorize?
// response_type=code&
// client_id=my_app_id&
// scope=openid%20profile%20email&
// redirect_uri=https://my-app.com/callback&
// nonce=random_string
// 2. User grants consent, redirected back with code
String authCode = "some_long_authorization_code"; // From redirect URI
// 3. Exchange code for tokens (server-side POST request)
System.out.println("Exchanging Authorization Code for tokens...");
// This part would typically be handled by an HTTP client
// sending a POST request to the token endpoint.
// The response would contain:
// {
// "access_token": "...",
// "token_type": "Bearer",
// "expires_in": 3600,
// "refresh_token": "...",
// "id_token": "..." // The OIDC addition!
// }
System.out.println("Received Access Token, Refresh Token, and ID Token!");
System.out.println("ID Token contains user identity claims.");
}
}OIDC Auth Code Flow Check
Consider an application implementing the OpenID Connect Authorization Code Flow.
Which of the following parameters is essential in the initial authorization request to ensure an ID Token is returned?
OIDC Auth Code Flow Recap
Great job! You've learned how the secure Authorization Code Flow is extended by OpenID Connect to provide both authorization and identity.
- We use
response_type=codeand include theopenidscope. - The Authorization Server returns an Authorization Code.
- This code is exchanged for an Access Token (for resource access) and an ID Token (for user identity).
- The ID Token is a JWT carrying user claims, signed by the Authorization Server.
This flow is highly recommended for confidential clients like web applications.
Belajar OAuth2 & OpenID Connect Deep Dive dengan tutor AI — gratis
Tulis dan jalankan kode asli di browser kamu, dapatkan bantuan instan dari tutor AI 24/7, dan lanjutkan di mana kamu tinggalkan di web atau aplikasi.
- Kursus
- 12
- Pelajaran
- 48
Pertanyaan yang Sering Diajukan
Apakah pelajaran “Alur Kode Otorisasi dengan OIDC” gratis?
Ya — teks lengkap “Alur Kode Otorisasi dengan OIDC” gratis dibaca di sini di web. Untuk praktiknya secara interaktif (editor kode bawaan dan tutor AI 24/7) dan buka sisa kursus OAuth2 & OpenID Connect Deep Dive, upgrade ke CoddyKit PRO. Kursus OAuth2 & OpenID Connect Deep Dive mencakup 4 pelajaran total.
Apa yang akan aku pelajari di “Alur Kode Otorisasi dengan OIDC”?
Terapkan Alur Kode Otorisasi yang aman, yang diperluas dengan OIDC untuk mengembalikan Token ID bersama token akses. Kamu berlatih OAuth2 & OpenID Connect Deep Dive dengan kode praktik yang langsung kamu jalankan di browser, dan tutor AI 24/7 menjawab pertanyaanmu saat kamu mengerjakan pelajaran ini.
Apakah aku perlu pengalaman untuk memulai OAuth2 & OpenID Connect Deep Dive?
Tidak diperlukan pengalaman sebelumnya. OAuth2 & OpenID Connect Deep Dive di CoddyKit dirancang untuk pemula hingga pelajar tingkat lanjut, jadi kamu bisa memulai di sini atau dari awal dan belajar sesuai kecepatan kamu sendiri. Ini adalah pelajaran 1 dari 4.
Berapa lama pelajaran “Alur Kode Otorisasi dengan OIDC” memakan waktu?
Sebagian besar pelajaran CoddyKit memakan waktu sekitar 5–10 menit. Setiap pelajaran ringkas dan interaktif, jadi kamu membuat kemajuan stabil dan melanjutkan dari tempat kamu tinggalkan di web dan aplikasi.
Bisakah aku menulis dan menjalankan kode dalam pelajaran OAuth2 & OpenID Connect Deep Dive ini?
Ya. Setiap pelajaran OAuth2 & OpenID Connect Deep Dive menyertakan editor kode bawaan, jadi kamu menulis dan menjalankan kode nyata langsung di browser dan mendapatkan umpan balik AI instan — tidak diperlukan penyiapan lokal.
Semua pelajaran dalam kursus ini
- Alur Kode Otorisasi dengan OIDC
- Alur Implisit dengan OIDC
- Alur Hibrida dengan OIDC
- Menggunakan nonce untuk Mencegah Pemutaran Ulang