Best Practices

Present the main security recommendations for integrating L’Identité Numérique La Poste.

👉 This page complements the OpenID Connect technical documentation.

The partner remains responsible for:

• its application
• its user accounts
• its sessions
• protecting the received data

LINLP secures authentication, but the integration must also be secured on the partner side.

⚠️ Mandatory

Sensitive calls must be performed server-side:

• `/token`
• `/userinfo`
• JWT processing

👉 The `client_secret` must never be exposed on the frontend.

⚠️ All exchanges must be protected through HTTPS:

• user redirections
• API calls
• callbacks
• partner login pages

The partner must validate `id_token` values:

• signature
• issuer (`iss`)
• audience (`aud`)
• expiration (`exp`)
• nonce (if used)

👉 See: Token Validation

⚠️ Strong recommendation

The `id_token` constitutes:

• proof of user authentication
• signed evidence
• an element that can be verified afterwards

👉 It should be retained according to the partner’s internal policies.

The partner must protect application sessions:

• session expiration
• secure cookies
• invalidation after logout
• protection against session theft

Restrict access to:

• LINLP credentials
• sensitive logs
• user data
• administration consoles

Keep appropriate records:

• authentication date / time
• user identifier (`sub`)
• session identifier
• id_token

⚠️ Comply with GDPR rules and internal retention policies.

Apply the minimization principle:

• request only necessary scopes
• store only useful data
• protect sensitive data

• Securing LINLP also means securing the partner integration
• Backend + HTTPS are mandatory
• JWT validation is required
• id_token should be retained as evidence

👉 Validate JWTs:

Token Validation