<html><head><style type="text/css"><!-- DIV {margin:0px;} --></style></head><body><div style="font-family:tahoma,new york,times,serif;font-size:10pt;color:#000000;"><span>While trying to resolve issue # 31 ( <a target="_blank" href="https://bitbucket.org/openid/connect/issue/31/standard-5121-inconsistency-with-messages">https://bitbucket.org/openid/connect/issue/31/standard-5121-inconsistency-with-messages</a> ) in the Issue Tracker, the working group runs in to the problem of how to return authorization responses when multiple response_types are requested.</span><br><br>According to the OAuth 2.0 specs, the responses are returned as follows :<br><br>response_type
response<br>-----------------------------------------------------<br>code code returned in the query<br>token token returned in the fragment<br><br>code token unspecified (leave open for possible extension spec to register response_type combination)<br><br>code id_token<br>token id_token<br>code token id_token <br><br><br>For the unspecified cases, John Bradley holds the position that if a fragment is returned,
then all parameters are returned in the fragment. Others (Nat, Edmund) believes that code should be returned in the query while token and id_token are always returned in the fragment.<br><br>We would like to request consensus from the group on how to handle such responses, so that the responses for the specified combinations can be clearly specified and registered with OAuth.<br><br>-- Edmund<br><div><br></div>
</div></body></html>