Gain insights into JWT, OAuth2, and OpenID Connect. Learn about HTTPS, encryption, and handshake techniques, and explore foundational concepts in web API security for enhanced application protection.

Web application developers are always on the lookout for ways to secure their applications. It has become the most fundamental part of any web application considering the rise in the number of cyber-attacks. This course will be your handy guide to the basic terminologies and frameworks related to web application security.

 In this course, you will learn what JWT is, how a JWT is created, and what benefits it provides in token-based authentication. You will learn about why HTTPS was introduced and how it revolutionized the way data is transferred using techniques like encryption and handshake. You will also dive deep into the most commonly used authentication and authorization frameworks called OAuth and OpenId Connect. This course will give you a taste of what web API security is all about and will give you the foundation so you can further your learning of application security.

Web Security and Access Management: JWT, OAuth2 & OpenId Connect

This flow is also similar to the Implicit grant type discussed in the [OAuth chapter](https://www.educative.io/courses/web-security-access-management-jwt-oauth2-openid-connect/implicit-grant-type). This flow is used for single-page JavaScript apps or those apps which do not have a backend.

In Implicit flow, the `response_type` field can either take `token` or `id_token` or `token_id_token` as value. This leads to some interesting cases depending upon what is provided in the `scope` field.




# Implicit flow types

There are different implicit flows for different values of the `response_type` and `scope` field.

## 1. `response_type=token`

When the value of `response_type` is `token`, then only the access token is returned. Even if **openid** is included in the `scope` request parameter, an ID token is not issued. 

> This flow uses the authorization endpoint only. It does not use the token endpoint.

![](/api/collection/6650775272947712/6366281604268032/page/6599592750612480/image/6293599651102720)

![](/api/collection/6650775272947712/6366281604268032/page/6599592750612480/image/5585717267791872)

## 2. `response_type=id_token`

When the value of `response_type` is `id_token`, then only the identity token is returned. The `scope` field must contain `openid`.

> This flow uses the authorization endpoint only. It does not use the token endpoint.

![](/api/collection/6650775272947712/6366281604268032/page/6599592750612480/image/5642181021794304)

![](/api/collection/6650775272947712/6366281604268032/page/6599592750612480/image/6532906303356928)


## 3. `response_type="token id_token"`

When the value of `response_type` is `token id_token`, then both access token and identity token is returned. The value of the `scope` field must contain `openid`, otherwise the identity token will not be returned.

When an access token is issued together with an ID token from the authorization endpoint, the hash value of the access token calculated in a certain way has to be embedded in the ID token.

> This flow uses the authorization endpoint only. It does not use the token endpoint.

![](/api/collection/6650775272947712/6366281604268032/page/6599592750612480/image/6403436191940608)

![](/api/collection/6650775272947712/6366281604268032/page/6599592750612480/image/6671934495391744)

This lesson discusses the Implicit code flow of the OpenID Connect.

Getting started with Web Application Security

HTTPS Basics

JSON Web Token

OAuth

OpenID Connect

Conclusion

Implicit Code Flow for Authentication