After authenticating with a provider, an application will often receive both an ID token and an access token on behalf of the user. Now it seems there are two ways to assert who the user is.
- Verify the ID token and then read the ID token.
- Pass the access token to the userinfo endpoint and read the JSON response.
Both seem like acceptable avenues, but are there certain scenarios in which one or the other should be used?