CODEWITHSUNDEEP
oauthoauth-2.0openid-connect
James
James

Reputation: 12182

Usage of response_type="code token" in OAuth 2?

The OpenID Connect Spec OAuth 2.0 Multiple Response Type Encoding Practices states that multiple response_type can be combined, e.g. response_type="code token". Now I'm wondering what it's good for to request an authorization code and the token. Isn't the auth code superfluous if you have the token already?

Upvotes: 3

Views: 3775

Answers (2)

Hans Z.
Hans Z.

Reputation: 53928

OAuth 2.0 is a protocol framework on top of which other protocols can be built and OpenID Connect is an example of such a protocol.

Especially for OpenID Connect it makes sense to use combined response types because there are 2 tokens in play: the access_token and the id_token. Using "response_type" the client can request how each of the tokens should be delivered.

In the example that that you give, the access_token will be delivered through the front channel as part of the authentication response but the id_token will be delivered when exchanging the "code" for an id_token at the token endpoint in a backchannel call.

A reason for doing this may be that the id_token, which is a signed JWT, does not have to be verified locally when obtained from a proper TLS protected token endpoint, so the client code can be simple. The access_token is opaque to the client anyhow and does not benefit from that.

Upvotes: 6

Eugenio Pace
Eugenio Pace

Reputation: 14212

I've never seen this used in practice. Yes, having the token already kind of diminishes the value of using the code flow.

Upvotes: 2

Related Questions