CODEWITHSUNDEEP
oauth-2.0access-tokenopenid-connect
MAK
MAK

Reputation: 2283

What is the use of two id/access tokens (from authorize and token endpoints) received in Hybrid flow/grant?

In Hybrid Flow/Grant - 

    response_type = code token id_token

In this case, the client receives id_token & access_token 2 times:

1) From /authorize endpoint (along with code)

2) From /token endpoint (exchanges code for token)

I read in few sites that these tokens, received twice, may not be same always. What is the use of receiving tokens twice? How are they used? Isn't just getting the code from authorize endpoint and exchange it with token endpoint for tokens enough (i.e., Authorization code flow)?

Upvotes: 0

Views: 105

Answers (1)

Hans Z.
Hans Z.

Reputation: 53928

I'm afraid this is not a widely understood or agreed on part of the spec. One may argue that receiving tokens from a backchannel is inherently more secure thus there's a security and assurance advantage over getting them in the front channel. I don't think anyone has presented a compelling use case though for also receiving tokens in the front channel in the same flow.

Upvotes: 1

Related Questions