Open ID Connect Multiple response types

user_301032 0
Viewed 84

With Open ID Connect, what is the value of the code id_token token response type when using the hybrid flow?

This returns a response containing an authorisation code, identity token and access token. Given you already have the access token in the response, the authorisation code is redundant?

openid-connect
2 Answers

You can get a refresh token at the token endpoint using the authorization code.

user_11816210

Answer for this can vary on the exact implementation. This is justifiable by what OpenID Connect specification mentions in the protocol document.

There is a dedicated token endpoint explanation given under Hybrid flow. According to that,

ID Token

When using the Hybrid Flow, the contents of an ID Token returned from the Token Endpoint are the same as for an ID Token returned from the Authorization Endpoint

There are few exceptions like,

  • Omitting at_hash and c_hash Claims in Id token from token endpoint
  • Restricted (limited) claims in Id token from authorization endpoints

Now that second one is implementation specific. So you might find few differences or you may see them as identical.

Unless you have special requirement, I recommend to stick with authorization code flow. It is more secure and even OAuth working group suggests not to obtain tokens from authorization response (i.e - Implicit flow).

user_31970550
Related