[Openid-specs-ab] Defining a Hardened (Mix-up and Cut-and-Paste Proof) OpenID Connect Profile

[Torsten Lodderstedt]

Am 12.04.2016 um 23:28 schrieb John Bradley:
> Basically fragment encoding is not a good idea any more other than for 
> JS in the browser or for native apps using view controllers or system 
> browsers.
>
> Servers really should support the form post response mode.

This should go into the new security threat model and mitigations 
document we talked about in the OAuth session.