Cybersecurity glossary
What is OIDC `nonce`?
Learn what the OpenID Connect nonce is, how it binds ID tokens to a login session, how it differs from OAuth state, and validation rules clients must enforce.
Definition
OIDC `nonce` is a client-generated string included in the authentication request and returned as an ID token claim so the client can verify that the token was issued in response to its own login flow, mitigating certain ID token replay and injection attacks.
Why ID tokens need their own binding value
OAuth state proves the browser callback matches the session that started login. Clients still need proof that an ID token itself was minted for that attempt—not copied from elsewhere. OIDC nonce provides that binding inside the identity assertion.
How nonce works end to end
Client creates nonce
Generate a cryptographically random string when building the authentication request.
Store nonce with the login session
Keep it server-side or in a sealed browser session until validation completes.
Send nonce to the OpenID provider
Include it on the authorize request alongside state, PKCE, and scopes.
Provider echoes nonce in the ID token
The signed JWT contains a nonce claim equal to the request value.
Client compares before trusting identity
Mismatch or missing nonce means reject the token and abort login.
Threats nonce mitigates
ID token injection
Attacker tries to make the client accept an ID token from another flow.
Replay to the client
Old ID tokens reused against a client that does not bind sessions.
Mix-up confusion aids
Helps ensure the token corresponds to the transaction the client started.
Implicit-flow legacy risks
Historically critical when tokens returned in front-channel URLs.
nonce vs state vs PKCE
| Value | Travels in | Purpose |
|---|---|---|
| state | Authorize request + callback query | CSRF protection on redirect |
| nonce | Authorize request + ID token claim | Bind ID token to client session |
| PKCE verifier | Token request | Bind code redemption to client |
Validation checklist
- Generate a unique high-entropy nonce per authentication attempt.
- Send nonce on every OIDC login that returns an ID token to your client.
- Verify the ID token signature before trusting the nonce claim.
- Reject tokens with missing or mismatched nonce values.
- Invalidate stored nonce after successful login or timeout.
- Do not confuse access-token APIs with ID-token nonce checks.
- Use nonce together with state and PKCE—not as a replacement.
- Prefer authorization code + PKCE so ID tokens are not exposed in URLs.
The practical takeaway
OIDC nonce ties an ID token to the login your client started. Without it, identity assertions are easier to replay or inject into a relying party.
Create strong nonces, echo-check them on every ID token, and keep them distinct from OAuth state and PKCE—which protect other parts of the same flow.
Related security terms
ID Token
Token that must contain and match the expected nonce claim.
OAuth `state`
Separate CSRF control for the OAuth redirect callback.
OpenID Connect (OIDC)
Protocol that defines nonce for authentication requests.
Token Replay
Broader replay threat class nonce helps address for ID tokens.
JWT (JSON Web Token)
Format typically used for ID tokens carrying nonce.
Frequently asked questions
What is an OIDC nonce in simple terms?
It is a random value your app creates at login start. The identity provider puts the same value inside the ID token so your app knows the token belongs to that login attempt.
Is nonce the same as state?
No. State protects the redirect endpoint from CSRF. Nonce protects the ID token association with the client session. OIDC browser apps should use both.
When is nonce required?
OpenID Connect requires nonce for implicit flows and recommends it for authorization code flows that return ID tokens to the client—treat it as mandatory in modern apps.
Where is nonce validated?
By the client (relying party) when verifying the ID token—not by the resource server consuming access tokens.
How long should a nonce be?
Long enough for high entropy—typically 128 bits or more of randomness—stored only for the duration of the login attempt.
What if the nonce claim is missing?
If you sent a nonce in the request, reject ID tokens that omit it or present a different value.
Does PKCE replace nonce?
No. PKCE binds the authorization code to the client. Nonce binds the ID token to the authentication transaction. They solve different problems.
References
Explore authoritative guidance and frameworks related to oidc `nonce`.
Explore every security definition
Return to the glossary to search by term, alias, starting letter, or security category.