[Openid-specs-ab] Defining a Hardened (Mix-up and Cut-and-Paste Proof) OpenID Connect Profile

[John Bradley]

Yes.

We should also work on a alternative for fragment for in browser JS.  We do have a couple of proposals at this point.

> On Apr 14, 2016, at 6:02 AM, Torsten Lodderstedt <torsten at lodderstedt.net> wrote:
> 
> Am 12.04.2016 um 23:28 schrieb John Bradley:
>> Basically fragment encoding is not a good idea any more other than for JS in the browser or for native apps using view controllers or system browsers.
>> 
>> Servers really should support the form post response mode.
> 
> This should go into the new security threat model and mitigations document we talked about in the OAuth session.
>