2

I'm trying to understand the Hybrid flow of OIDC. Am I correct in thinking that an authentication request is made to the authorization endpoint, which then responds with the authorization code, id token and the token in the URL fragment?

If that's the case what's the point of returning an authorization code if it's not going to be exchanged for an access and id token?

3.3.2.5. Successful Authentication Response

When using the Hybrid Flow, Authentication Responses are made in the same manner as for the Implicit Flow, as defined in Section 3.2.2.5, with the exception of the differences specified in this section.

These Authorization Endpoint results are used in the following manner:

access_token
OAuth 2.0 Access Token. This is returned when the response_type value used is code token, or code id_token token. (A token_type value is also returned in the same cases.)

id_token
ID Token. This is returned when the response_type value used is code id_token or code id_token token.

code
Authorization Code. This is always returned when using the Hybrid Flow.

The following is a non-normative example of a successful response using the Hybrid Flow (with line wraps for the display purposes only):

HTTP/1.1 302 Found   Location: https://client.example.org/cb#
code=SplxlOBeZQQYbYS6WxSbIA
&id_token=eyJ0 ... NiJ9.eyJ1c ... I6IjIifX0.DeWt4Qu ... ZXso
&state=af0ifjsldkj
0

The only way to get a refresh token is via the token endpoint using an auth code. Personally I’d not bother with “code id_token token” and just use “id_token code” instead.

0

As mackie already mentions, an Refresh Token are only issued at the Token Endpoint, so an Authorization Code is needed to get one. If your web application needs the ID Token in the URL for some reason and you need the Refresh Token, the Hybrid Flow might fit your needs.

Another point is the flexibility of the Hybrid Flow: Depending on your use case and the abilities of your OpenID Provider, you might want an ID Token in the URL like in the Implicit Flow and the Access Token returned by the Token Endpoint to your backend requesting it with the code.

The Hybrid Flow also allows your application to get two ID Token: One with less sensitive data in the frontend and another with more sensitive data in the backend:

If an ID Token is returned from both the Authorization Endpoint and from the Token Endpoint, which is the case for the response_type values code id_token and code id_token token, the iss and sub Claim Values MUST be identical in both ID Tokens. All Claims about the Authentication event present in either SHOULD be present in both. If either ID Token contains Claims about the End-User, any that are present in both SHOULD have the same values in both. Note that the OP MAY choose to return fewer Claims about the End-User from the Authorization Endpoint, for instance, for privacy reasons.

(Excerpt from 3.3.3.6. ID Token)

This is also possible for the Access Token:

If an Access Token is returned from both the Authorization Endpoint and from the Token Endpoint, which is the case for the response_type values code token and code id_token token, their values MAY be the same or they MAY be different. Note that different Access Tokens might be returned be due to the different security characteristics of the two endpoints and the lifetimes and the access to resources granted by them might also be different.

(Excerpt from 3.3.3.8. Access Token)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.