<html><head><base href="x-msg://181/"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; ">+1 for code in query and token in fragment<div><br><div>I don't get the reason why (mainly JS) clients need code in fragment even when token is already there.</div><div><br><div><div>On 2011/09/16, at 9:33, Edmund Jay wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite"><span class="Apple-style-span" style="border-collapse: separate; font-family: Helvetica; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-border-horizontal-spacing: 0px; -webkit-border-vertical-spacing: 0px; -webkit-text-decorations-in-effect: none; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; font-size: medium; "><div><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; font-family: tahoma, 'new york', times, serif; font-size: 10pt; color: rgb(0, 0, 0); "><span>While trying to resolve issue # 31 (<span class="Apple-converted-space"> </span><a target="_blank" href="https://bitbucket.org/openid/connect/issue/31/standard-5121-inconsistency-with-messages">https://bitbucket.org/openid/connect/issue/31/standard-5121-inconsistency-with-messages</a><span class="Apple-converted-space"> </span>) in the Issue Tracker, the working group runs in to the problem of how to return authorization responses when multiple response_types are requested.</span><br><br>According to the OAuth 2.0 specs, the responses are returned as follows :<br><br>response_type response<br>-----------------------------------------------------<br>code code returned in the query<br>token token returned in the fragment<br><br>code token unspecified (leave open for possible extension spec to register response_type combination)<br><br>code id_token<br>token id_token<br>code token id_token <span class="Apple-converted-space"> </span><br><br><br>For the unspecified cases, John Bradley holds the position that if a fragment is returned, then all parameters are returned in the fragment. Others (Nat, Edmund) believes that code should be returned in the query while token and id_token are always returned in the fragment.<br><br>We would like to request consensus from the group on how to handle such responses, so that the responses for the specified combinations can be clearly specified and registered with OAuth.<br><br>-- Edmund<br><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; "><br></div></div>_______________________________________________<br>Openid-specs-ab mailing list<br><a href="mailto:Openid-specs-ab@lists.openid.net">Openid-specs-ab@lists.openid.net</a><br><a href="http://lists.openid.net/mailman/listinfo/openid-specs-ab">http://lists.openid.net/mailman/listinfo/openid-specs-ab</a><br></div></span></blockquote></div><br></div></div></body></html>