title: Where to validate nonce in OAuth 2.0 Implict Flow?
body: <p>I have the following architecture.</p>
  
  <p><a href="https://i.stack.imgur.com/D35yf.png" rel="noreferrer"><img src="https://i.stack.imgur.com/D35yf.png" alt="enter image description here"></a></p>
  
  <p>Where:</p>
  
  <ul>
  <li>Client - is a single page JavaScript application.</li>
  <li>Authorisation server - is Azure AD.</li>
  <li>Resource server - is an Azure App Service using <a href="https://docs.microsoft.com/en-gb/azure/app-service/app-service-authentication-overview" rel="noreferrer">Azure AD authentication</a>.</li>
  <li>All communications are secured using HTTPS.</li>
  </ul>
  
  <p>I am using <a href="https://docs.microsoft.com/en-us/azure/active-directory/develop/active-directory-v2-protocols-implicit" rel="noreferrer">Implicit Flow</a> to access a JWT access token from Azure AD.</p>
  
  <pre><code>https://login.microsoftonline.com/{tenant}/oauth2/v2.0/authorize?
  client_id=6731de76-14a6-49ae-97bc-6eba6914391e
  &amp;response_type=id_token+token
  &amp;redirect_uri=http%3A%2F%2Flocalhost%2Fmyapp%2F
  &amp;scope=openid%20https%3A%2F%2Fgraph.microsoft.com%2Fmail.read
  &amp;response_mode=fragment
  &amp;state=12345
  &amp;nonce=678910
  </code></pre>
  
  <p>This JWT token is then later passed to the resource server as a Bearer authorization. The same token could be reused multiple times before it expires.</p>
  
  <p>As part of the Authorize request I pass state and a nonce value.</p>
  
  <p>Presently I validate the state on my client in JavaScript using a simple <code>if</code>:</p>
  
  <pre><code>function isValid() {
      if (token.state !== expectedState) {
          return false;
      }
  
      ...
  }
  </code></pre>
  
  <p>If I understand correctly the nonce is to prevent replay attacks - which I assume meant against my resource server, but perhaps also against the <a href="https://security.stackexchange.com/questions/3001/what-is-the-use-of-a-client-nonce">client</a>.</p>
  
  <p>I am unsure where (or if) I should validate the nonce. </p>
  
  <p>On the server doesnt seem right, the token as a whole is being validated, and the token is meant to be reusable (within its expiry).</p>
  
  <p>On the client, seems to be a better location, but is that any different to validating the state?</p>