DeepFrontend
Learning Paths
Practice
System Design & DS
Design Studio
Data Structures Curriculum
Real-World Case Studies
Careers
Job Board
Resume Builder
Blog
Sign in
Search
⌘K
Go Pro
Loading compiler resources...
API Development Quiz Practice
Active Recall Drill Session
← Exit Session
Question 1 of 1
medium
API Development
A code review finds an app decoding the access_token to extract a 'name' field for display purposes, assuming this works reliably across any OAuth provider. What's the issue?
A
No issue — access tokens are always JWTs with this exact field
B
Access token format/claims are not guaranteed by the OAuth spec — some providers issue fully opaque access tokens with no decodable content at all; the id_token is the correct, guaranteed source for identity-related claims
C
This is only a problem for Google's OAuth implementation specifically
D
JWTs cannot contain a name field under any circumstances
Check Answer