Although I think OpenID 2.0 is a cleaner and better authentication protocol than OpenID Connect, I have to implement an OpenID Connect IdP.
One point I like in OpenID 2.0 is that the IdP can return a signed identity to the Relying Party (through the user agent) and there’s no additional round-trip between the RP and the IdP.
At first sight, OpenID Connect defines an “Implicit” flow which looks fine to me. But when I look at the details, it seems to be designed only to be used with “Clients implemented in a browser using a scripting language”.
I thought that I might anyway use the “Implicit” flow with a server-side RP, using the “query” Response Mode, but the “OAuth 2.0 Multiple Response Type Encoding Practices“ document explicitly forbids the use of “query” Response Mode with the id_token response type…
Why is it forbidden ? And more generally, why is the “Implicit“ flow frowned at?
As I understand it, as long as the ID tokens are signed, and the RP use (and verify) nonces, the “Implicit” flow should be safe.