title: Is it insecure to pass id_token to browser code?
body: <p>I've been digging deep into OAuth2 / OpenID Connect(OIDC) and in many ways I feel smarter, but in many ways, I'm worried that a simple mistake will leave me vulnerable. I'm building super standard business apps. So time to ask for directions:</p>
  
  <ul>
  <li><strong>Platform</strong>: Pivotal Cloud Foundry / UAA</li>
  <li><strong>Backend</strong>: Spring Boot 1.5.x (but looking at 2.0 now)</li>
  <li><strong>Frontend</strong>: React SPA</li>
  <li><strong>OAuth2</strong>: Auth Code Grant with <code>openid</code> scope</li>
  </ul>
  
  <p>I'm getting the <code>id_token</code>, <code>access_token</code>, and <code>refresh_token</code></p>
  
  <p>I have a million questions, but lets start with the basics:</p>
  
  <ol>
  <li><p>Is it ok to take the <code>id_token</code> and just send it to the react code in the browser and have it stored in Session Storage? Otherwise how exactly is the UI suppose to know information about the person logged in?</p></li>
  <li><p>If I have the <code>id_token</code>, do I still care about the <code>/userinfo</code> endpoint? My guess is no. </p></li>
  <li><p>Every time the UI makes a call to the api it passes the auth code?  Does the spring code in turn make a call to the <code>/oauth/token</code> every time?  Should (or Does) the Spring Code cache the relationship between the auth code and returned tokens?</p></li>
  </ol>