As I was working on a blog series about OpenID connect with Angular I was working with an Angular library for OpenID connect called angular-auth-oidc-client. This library is used for implementing OpenID connect implicit flow and does client validation of both the ID token and access token.

My questions are:

1. Since Angular apps lives in the browser, which contains javascript files that can be tampered with, by a mallicous user who has eg. sniffed another users access token, to disable ID token validation, **isn’t it pointless to do ID token validation in a browser**? I know the ID token is used by the client for verifying authentication, **but does it provide any security when this is done in the browser**?

	2. Would it be a better implementation **to not validate the ID token in the browser and instead use a front End server for validating ID token** before requesting a resource API?

My question is NOT about the specification of OpenID connect, but about using a browser for id token validation. I have created a blog post [here](https://blog.christianlydemann.com/post/openid-connect-part1-openid-connect-overview/), where im explaining OpenID connect on a practical level.

Thank you.