<html><head><meta http-equiv="Content-Type" content="text/html charset=us-ascii"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">Hi Dave,<div class=""><br class=""><div><blockquote type="cite" class=""><div class="">Am 07.11.2017 um 00:35 schrieb Dave Tonge <<a href="mailto:dave.tonge@momentumft.co.uk" class="">dave.tonge@momentumft.co.uk</a>>:</div><br class="Apple-interchange-newline"><div class=""><span style="font-family: 'trebuchet ms', sans-serif; font-size: 14px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; float: none; display: inline !important;" class="">he token response sent to this endpoint has an id_token. We suggested that this id_token should include an `at_hash`. This will give the client greater assurance that the token response is from the OpenID Provider and of the integrity of the payload.<span class="Apple-converted-space"> </span></span></div></blockquote><br class=""></div><div>can you elaborate on the threat model underpinning this decision? </div><div><br class=""></div><div>best regards,</div><div>Torsten.</div><br class=""></div></body></html>