<html><head><meta http-equiv="Content-Type" content="text/html charset=windows-1252"><base href="x-msg://611/"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; ">The nonce is sent in the authorization request. It is returned in the id_token if sent in the authorization request.<div><br></div><div>The nonce is optional in basic. It provides a way of binding the original request to the id_token returned and preventing replay attacks in the implicit flow.</div><div><br></div><div>The nonce is not sent with code to the token endpoint.</div><div><br></div><div>John B.</div><div> </div><div><br></div><div><br><div><div>On 2012-11-29, at 9:27 PM, Sascha Preibisch <<a href="mailto:spreibisch@layer7tech.com">spreibisch@layer7tech.com</a>> wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite"><div lang="EN-US" link="blue" vlink="purple" style="font-family: Helvetica; font-size: medium; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; "><div class="WordSection1" style="page: WordSection1; "><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; ">Hi!<o:p></o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; "><o:p> </o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; ">I tried to find an answer for my question in older mailing list posts but I did not find it.<o:p></o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; "><o:p> </o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; ">I would like to know if a basic client profile client should pass in the optional “nonce” parameter with the initial authorization request or when requesting an “access_token” in exchange for the “code”. I assume the spec refers to the initial request.<o:p></o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; ">As a client I do not really care when it has to be passed in. But as a server I would prefer to receive the “nonce” when the client exchanges the “code” for an “access_token”.<o:p></o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; "><o:p> </o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; ">Thanks,<o:p></o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; ">Sascha<o:p></o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; "><o:p> </o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; "><b><span style="font-size: 9pt; color: rgb(23, 54, 93); ">Sascha Preibisch</span></b><span style="color: rgb(31, 73, 125); "><o:p></o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; "><b><span style="font-size: 9pt; color: rgb(23, 54, 93); ">Senior Software Developer, Tactical Team<o:p></o:p></span></b></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; "><b><span style="font-size: 9pt; color: rgb(23, 54, 93); ">Layer 7 Technologies</span></b><span style="color: rgb(31, 73, 125); "><o:p></o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; "><span style="font-size: 9pt; color: rgb(31, 73, 125); ">405-1100 Melville St. Vancouver BC, V6E 4A6<o:p></o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; "><span style="font-size: 9pt; color: rgb(31, 73, 125); "><a href="mailto:spreibisch@layer7tech.com" style="color: purple; text-decoration: underline; "><span style="color: blue; ">spreibisch@layer7tech.com</span></a><o:p></o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; "><span style="font-size: 9pt; color: rgb(31, 73, 125); ">(778) 328-5288<o:p></o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; "><span style="font-size: 9pt; color: rgb(31, 73, 125); "><a href="http://www.layer7tech.com" style="color: purple; text-decoration: underline; ">http://www.layer7tech.com</a><o:p></o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; "><b><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(0, 0, 127); "><image001.png></span></b><o:p></o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; "><o:p> </o:p></div></div>_______________________________________________<br>Openid-specs-ab mailing list<br><a href="mailto:Openid-specs-ab@lists.openid.net" style="color: purple; text-decoration: underline; ">Openid-specs-ab@lists.openid.net</a><br><a href="http://lists.openid.net/mailman/listinfo/openid-specs-ab" style="color: purple; text-decoration: underline; ">http://lists.openid.net/mailman/listinfo/openid-specs-ab</a><br></div></blockquote></div><br></div></body></html>