I’m currently trying to authenticate an user with Node.JS and Vue. I followed the quickstarts of these two sdk. I already succeeded to get the id_token containing the user info, and the access token for my API. I set the express jwtCheck and I can authenticate the user and restrict some routes. The last thing I want to do is to get user info in express by passing the access token. Should I call the userinfo endpoint each time I want to have user info in express ? I think it would be too much requests instead of directly passing the id_token to the server.
Thanks ! I found what I was doing wrong. The error message was that the audience was wrong, because the id token uses the Client ID for audience, I just changed that in my express server and it works.
But I have one more question:
Is it really secure to use the id token for authentication ?