oidc-validation

仓库创建 2026年7月26日最近提交 18 小时前SkillHot 收录 4 小时前

▸ 精选理由

防止因验证缺失导致的身份伪造或重放攻击。

这个 Skill 做什么

列出 OIDC ID Token 的必要校验与常见遗漏点。

列出 OpenID Connect 的 ID Token 必须做的校验（如签名、aud、iss、exp、nonce、alg 等）和常见被遗漏的点，防止身份被伪造或重放。任何集成“以 X 登录”的客户端都应该用，适合在接入 OIDC 时做安全检查。特别提醒那些常被跳过但会导致账户接管的校验项，帮你把登录链路从信任盲区变成可验证的流程。

▸ 展开 SKILL.md 英文原文

Use when an app uses OpenID Connect for login — validating ID tokens correctly so an attacker can't forge or replay an identity, and the checks that are commonly skipped.

研究检索OIDCID Token验证通用

Stars

Forks

仓库内 Skill

积累中

7 日增星

安装 / 使用

给你的 Agent 一句话（通用）

帮我安装这个 skill：https://raw.githubusercontent.com/jihedbfr-art/cyber-skills/main/skills/11-identity-and-access-management/02-oidc-validation/SKILL.md

或 curl 直取 SKILL.md

curl -fsSL "https://raw.githubusercontent.com/jihedbfr-art/cyber-skills/main/skills/11-identity-and-access-management/02-oidc-validation/SKILL.md"

SKILL.MD 节选查看完整文件 ↗

## Purpose

OpenID Connect adds authentication on top of OAuth2, and the ID token is its proof of who logged in. That proof only holds if the app validates the token properly — the wrong checks skipped, and an attacker forges or reuses an identity. This skill covers the ID-token validation an OIDC client must do, and the gaps that turn "log in with X" into account takeover.

## When to use it

Any app that logs users in via OIDC — "Sign in with Google/Microsoft/Okta", or a custom identity provider. It complements the OAuth2 skill (which covers the flow) by focusing on what the client must verify about the token it gets back.

## The checks an OIDC client must perform

Validate all of these o

via SKILL·HOT · 数据来自 GitHub 公开信息 · 原文版权归作者所有