Why implicit and Hybrid are not suported?

[jolivaSan]

I have been testing the library and when trying to use oauth.validateAuthResponse() I have found that implicit and hybrid flow are not supported and also in the README i see that are out of the scope, what is the reason for this? I was thinking in maybe do a PR but as is out of the scope of the library...

Best regards.

[panva]

Hi @jolivaSan,

I have not encountered a strong argument for having to support these flows. Care to elaborate on why you think a given response_type that falls into the implicit / hybrid category should be supported?

[jolivaSan]

We are thinking in use concretely 'code id_token' so as response of the /authorize endpoint we get an id_token purely to add extra security and validations in our Public clients, you know the c_hash, s_hash....

[panva]

The use of openid using code+pkce is easier and likewise protects the application from code injection and CSRF. Plus the enforcement logic is server side - win.

[panva]

Target profiles of this software are OAuth 2.1, OAuth 2.0 complemented by the latest Security BCP, and FAPI 2.0.

[jolivaSan]

ok, thanks for the explanation, i would like to use the 'code id_token' so we get a signed id_token in the authorization response so we can ensure that the response comes from the 'party' that we expect, we are having a look to the JARM as replace for this id_token.