Study. uk . com
  1. Home
  2. All questions
  3. Question 296

CompTIA Security+ study material · question 296 of 611

A developer uses the presence of a valid OAuth 2.0 access token as proof of the user's identity. Why is this a mistake?

  1. OAuth 2.0 requires SAML for identity claims
  2. Access tokens expire too quickly to be reliable
  3. OAuth 2.0 is a delegated authorisation protocol, not an authentication protocol
  4. Access tokens cannot be validated by the resource server
Show the answer

Answer: C. OAuth 2.0 is a delegated authorisation protocol, not an authentication protocol

A token says a client was granted access, not who is present. OpenID Connect exists to add the identity layer.

Challenge yourself on this topic → Study as cards