<html><head><meta http-equiv="Content-Type" content="text/html charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">The server always needs to honour any request from a client with nonce in it. It is optional for the client to send nonce with the “code” response type.<div class=""><br class=""></div><div class="">The WG only decided to relax the requirement for nonce in code, That doesn’t mean that sending and validating it is not a useful security precaution.</div><div class=""><br class=""></div><div class="">We backed off on nonce for code to make the basic profile simpler.</div><div class=""><br class=""></div><div class="">John B.<br class=""><div class=""><br class=""><div><blockquote type="cite" class=""><div class="">On Apr 13, 2015, at 3:04 PM, Mike Jones <<a href="mailto:Michael.Jones@microsoft.com" class="">Michael.Jones@microsoft.com</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div class="WordSection1" style="page: WordSection1; font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;"><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class="">Garyl Erickson of ForgeRock identified a place where the tests didn’t match the spec and Roland just adjusted the tests as a result. I wanted to document this change and the reason for it for the working group.<o:p class=""></o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""> </o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class="">OP-nonce-NoReq-code is about supporting requests without a nonce. The nonce is only needed when the ID Token is returned as a fragment. The code+token flow doesn't return the nonce as a fragment. Therefore, it should be legal to make a request with no nonce for code+token. So the test tool had included the test OP-nonce-NoReq-code for both the code and code+token response types.<o:p class=""></o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""> </o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class="">But the spec says that a nonce is required for Hybrid flows:<span class="Apple-converted-space"> </span><a href="http://openid.net/specs/openid-connect-core-1_0.html#HybridIDToken" style="color: purple; text-decoration: underline;" class="">http://openid.net/specs/openid-connect-core-1_0.html#HybridIDToken</a><span class="Apple-converted-space"> </span>3.3.2.11 ID Token "Use of the nonce Claim is REQUIRED for this flow." Therefore Roland just removed the OP-nonce-NoReq-code test from code+token, because it's testing for behavior that violates the spec. In this case while common sense may indicate that you don't have to send a nonce for code+token, the spec says that you do.<o:p class=""></o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""> </o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class="">In a related test, the OP-nonce-NoReq-noncode is about testing that implementations reject requests without a nonce. Roland and I *<b class="">did not</b>* add this test for the code+token flow because doing so would break existing implementations that have already passed certification with this functionality, which matches common sense, but not the spec. ;-) We *<b class="">did</b>* add this test for the code+id_token and code+id_token+token flows because the nonce really is required for security reasons in these cases. That being said, per the rules of the test freeze, we will honor any Hybrid certifications that have already occurred without these tests having been presented by the test tool.<o:p class=""></o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""> </o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class="">When errata time next comes around, we should think about whether to relax the requirement to include a nonce in the request for the code+token flow. But for now, I think it’s right for our certification tests to allow either the logical or the specified behavior in this one case.<o:p class=""></o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""> </o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""> Cheers,<o:p class=""></o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""> -- Mike<o:p class=""></o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""> </o:p></div></div><span style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; float: none; display: inline !important;" class="">_______________________________________________</span><br style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class=""><span style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; float: none; display: inline !important;" class="">Openid-specs-ab mailing list</span><br style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class=""><a href="mailto:Openid-specs-ab@lists.openid.net" style="color: purple; text-decoration: underline; font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class="">Openid-specs-ab@lists.openid.net</a><br style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class=""><a href="http://lists.openid.net/mailman/listinfo/openid-specs-ab" style="color: purple; text-decoration: underline; font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class="">http://lists.openid.net/mailman/listinfo/openid-specs-ab</a></div></blockquote></div><br class=""></div></div></body></html>