You are viewing a plain text version of this content. The canonical link for it is here.

Posted to dev@oltu.apache.org by "Antonio Sanso (JIRA)" <ji...@apache.org> on 2017/10/25 13:12:01 UTC

[jira] [Updated] (OLTU-204) When responseType equal to "id_token" the resulting token is passed back as a query parameter

     [ https://issues.apache.org/jira/browse/OLTU-204?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Antonio Sanso updated OLTU-204:
-------------------------------
    Labels: review  (was: )

> When responseType equal to "id_token" the resulting token is passed back as a query parameter
> ---------------------------------------------------------------------------------------------
>
>                 Key: OLTU-204
>                 URL: https://issues.apache.org/jira/browse/OLTU-204
>             Project: Apache Oltu
>          Issue Type: Bug
>            Reporter: Godwin Amila Shrimal
>              Labels: review
>
> When responseType equal to "id_token" the resulting token is passed back as a query parameter. This is incorrect as the OpenID Connect specification says that it must be sent back as a URL fragment (i.e. following hash instead of question mark). See http://openid.net/specs/oauth-v2-multiple-response-types-1_0.html#Security for more information.



--
This message was sent by Atlassian JIRA
(v6.4.14#64029)