Security and best practices

Validate:

1. Signature using JWK Set.
2. Issuer (iss) matches HSID issuer.
3. Audience (aud) contains your client_id.
4. Expiration (exp) has not passed.
5. Issued at time (iat) is reasonable.
6. ACR claim matches the requested acr_values (if applicable).

Reference : ID token content validation

Pairwise identifiers provide privacy by issuing different subject identifiers (sub claim) for the same user across different client applications. This prevents cross-correlation of user activities between unrelated services.

Reference : Pairwise identifier

The redirect_uri must exactly match a preconfigured URI in HSID (simple string comparison). It must be included in both the authorization request and token request. For dynamic parameters, use the state parameter instead of modifying redirect_uri.

Reference : Get started - application integration sign-in