Security with OpenId Connect

Many web applications need some way to identity the user, also known as authentication. Sometimes this is only to show the user what they were looking at before, so we need an identity to retrieve the user’s state from the server. Sometimes we need to protect certain resources, also known as authorization, which can be personal information, or contents that the user has paid for, or because of some legal requirement. In this chapter, we will look at OpenId Connect, and how we can use this to identify the user and decide what the current user can do.