specific response types need to be used in place of "implicit flow" and "code flow"

[Brian Campbell]

The terms "implicit flow" and "code flow" are not defined anywhere in the Connect specs and the way they are defined/used in OAuth doesn't really match up with how they are used in Connect.

There are some required behaviors now based on the flow being used but there seems to be quite a bit of ambiguity on what the flows really mean. It would be preferable to explicitly state the response type(s) that impact such requirements rather than using the loose terms of implicit and code flow.

This thread is one example of the confusion/ambiguity: http://lists.openid.net/pipermail/openid-specs-ab/Week-of-Mon-20120903/002350.html

[Michael Jones]

We need to do a general pass over the specs looking for "implicit", "code flow", "fragment encoded", etc.

[Michael Jones]

The key difference is how responses are encoded (fragment, etc.). We may want to say that the id_token response_type is part of the implicit flow.

[John Bradley]

Re #648 change references in nonce and at_hash to a response type of token if_token rather than implicit

→ <<cset a4ef4111364e>>

[John Bradley]

Re #648 change validation of id_token at_hash and c_hash to a response type of token id_token rather than implicit

→ <<cset 7eeb24b85898>>

[Brian Campbell]

I'm not sure using a "response type of token id_token rather than implicit" is really gonna do it?

In general, "token", "id_token", "id_token token", "code token", "code id_token", "code id_token token" all could be considered to be what was meant by the term implicit flow, right? Though some of the specific requirements only apply to a subset.

I think Mike was onto something in the observation about the key difference being in the nature of the response encoding - i.e. fragment vs. query.

[John Bradley]

Re #648 - Another attempt to make the wording for at_hash and c_hash clearer.

→ <<cset 42865e177d0c>>

[John Bradley]

I think Brian os OK with the latest wording

[Brian Campbell]

Yes, better now. Thanks. And nice commit comment too https://bitbucket.org/openid/connect/diff/openid-connect-messages-1_0.xml?diff2=ccbc74a066c5&at=default