How deeply does ASP.NET Core in Action, 3e cover OpenID Connect ID token?

Defines the token’s purpose and contrasts it with access tokens, without detailing its complete validation or issuance flow.

OpenID Connect ID token

As explained in ASP.NET Core in Action, 3e

An ID token is an OpenID Connect token that describes a user authentication event and may contain claims about the authenticated user.

An ID token describes a user authentication event in OpenID Connect and may carry claims about the authenticated user. It is a bearer token, but its purpose differs from an access token: an access token authorizes access to a resource, while an ID token communicates authentication information. section 25.2 section 25.2

Keep these token roles separate:

Use an access token to authorize access to a protected resource. section 25.2
Use an ID token to describe the authentication event and authenticated-user claims. section 25.2
Treat bearer tokens according to their purpose rather than assuming that every bearer token authorizes an API request. section 25.2

How ASP.NET Core in Action, 3e covers it

liveBook manning.com

Read ASP.NET Core in Action, 3e on liveBook Get the book at manning.com

Also explained in

liveBook manning.com

Software Security for DevelopersAn ID token is an OpenID Connect JWT containing claims about the authenticated end user and the authentication event.
liveBook manning.com

Secure APIsAn ID token is a token issued by an identity provider that conveys claims about an authenticated user or authentication event to a client.

Compare how 3 books explain OpenID Connect ID token →

Related concepts

JSON Web Tokenkind of · A JSON Web Token is a compact, URL-safe representation of claims encoded as a JSON object and protected by a digital signature, message authentication code, or encryption.
openid connectproduced by · OpenID Connect is an identity layer built on OAuth 2.0 that enables clients to authenticate end users and obtain standardized identity claims.
API keycontrasts with · An API key is a credential used to identify or authorize a client accessing an application programming interface.
tokenkind of · A token is a discrete unit of text, such as a word, word fragment, character, or symbol, represented and processed as an element by a language model.
bearer authenticationkind of · Bearer authentication is an authentication scheme in which presenting a bearer token is sufficient to use the access or authorization granted by that token.

This explainer was generated by Manning's knowledge graph from the text of ASP.NET Core in Action, 3e. The section links point to the parts of the book it draws on.