<html><head><meta http-equiv="Content-Type" content="text/html charset=iso-8859-1"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;">The response types "id_token token" and "id_token" are now covered in implicit. I think the language was intended to cover the "id_token" response type before refactoring.<div><br></div><div>The current text is not strictly incorrect but is misleading as the Authorization code is always requested in the Hybrid flow.<br><div><br></div><div>Nat and Ryo's proposed change is less confusing and is editorial in my opinion.</div><div><br></div><div>John B.</div><div><br></div><div><div><div>On Jan 5, 2014, at 2:04 AM, Nat Sakimura <<a href="mailto:sakimura@gmail.com">sakimura@gmail.com</a>> wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite"><div dir="ltr">Good catch. <div>Though, in hybrid flow, code is actually always returned in successful response so it would be </div><div><br></div><div><font face="courier new, monospace">- 5. Authorization Server Sends the End-User back to the Client with an ID Token and, if requested, an Authorization Code and/or Access Token.<br>
</font></div><div><font face="courier new, monospace">+ 5. Authorization Server Sends the End-User back to the Client with an ID Token, an Authorization Code and, </font><span style="font-family:'courier new',monospace">if requested, an</span><font face="courier new, monospace"> Access Token.</font></div>
<div><font face="courier new, monospace"><br></font></div><div><font face="arial, helvetica, sans-serif">If it does not return an authorization code, it is an implicit flow. </font></div></div><div class="gmail_extra"><br>
<br><div class="gmail_quote">2014/1/5 Ryo Ito <span dir="ltr"><<a href="mailto:ritou.06@gmail.com" target="_blank">ritou.06@gmail.com</a>></span><br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div dir="ltr"><div>Hybrid flow includes code in authorization response.<br></div><div><br></div><div>Step 5 should be corrected as follows.</div><div><br></div><div>- 5. Authorization Server Sends the End-User back to the Client with an ID Token and, if requested, an Authorization Code and/or Access Token.</div>
<div>+ 5. Authorization Server Sends the End-User back to the Client with an Code and, if requested, an Authorization ID Token and/or Access Token.</div><div><br></div><div>Thanks,</div><div>Ryo.</div><span class="HOEnZb"><font color="#888888"><div>
<br></div>-- <br>
====================<br>Ryo Ito<br>Email : <a href="mailto:ritou.06@gmail.com" target="_blank">ritou.06@gmail.com</a><br>====================
</font></span></div>
<br>_______________________________________________<br>
Openid-specs-ab mailing list<br>
<a href="mailto:Openid-specs-ab@lists.openid.net">Openid-specs-ab@lists.openid.net</a><br>
<a href="http://lists.openid.net/mailman/listinfo/openid-specs-ab" target="_blank">http://lists.openid.net/mailman/listinfo/openid-specs-ab</a><br>
<br></blockquote></div><br><br clear="all"><div><br></div>-- <br>Nat Sakimura (=nat)<div>Chairman, OpenID Foundation<br><a href="http://nat.sakimura.org/" target="_blank">http://nat.sakimura.org/</a><br>@_nat_en</div>
</div>
_______________________________________________<br>Openid-specs-ab mailing list<br><a href="mailto:Openid-specs-ab@lists.openid.net">Openid-specs-ab@lists.openid.net</a><br>http://lists.openid.net/mailman/listinfo/openid-specs-ab<br></blockquote></div><br></div></div></body></html>