how is the access token handled in the oidc-filter?

[dgn]

how is the access token handled in the oidc-filter?

[dgn]

I think it works with both. I haven't looked at it in a while, but I believe I only used the id_token because it is not as short-lived. You should be able to use them interchangeably

[d95776]

in general, id_token is used for user and access token is used for client app. I am not sure in the process flow implemented by the code where is the client app. is the browser app or the envoy proxy filter? looks like it is not the browser app since it does not have the client id/secret. it may also not be the envoy proxy filter since the envoy proxy filter is protecting the browser app to access the apis. It is hard to understand to use the filter to protect itself too.