oauth2.dev

code id_token token

OpenID_Foundation_Artifact_Binding_WG

Registry Context

`code id_token token` is an OpenID Connect composite response type that requests an authorization code, an ID Token, and an access token. RFC 6749 defines the syntax and comparison rules for registered composite response types but does not define this specific value.

Technical Summary

The decoded `response_type` value is a space-delimited set conforming to the RFC 6749 `response-type` ABNF. Component order is insignificant. Because this response type issues an access token in the authorization response, RFC 9700's security guidance for implicit-style responses applies.

When Used

Used in the OpenID Connect Hybrid Flow when the client requests an authorization code, ID Token, and access token from the authorization endpoint.

Normative Requirements

Clients

MUST
1

  1. RFC 6749 - Section 3.1.1

    Use `code`, `token`, or a registered extension value as the `response_type` value..

    Condition: When setting the authorization request's `response_type` parameter.

    The value MUST be one of "code", "token", or a registered extension value.

REQUIRED
1

  1. RFC 6749 - Section 3.1.1

    Include the `response_type` authorization request parameter..

    Condition: When making an authorization request using this response type.

    response_type REQUIRED.

SHOULD NOT
1

  1. RFC 9700 - Section 2.1.2

    Use response types that issue access tokens in the authorization response..

    Condition: Unless access-token injection is prevented and the identified token-leakage vectors are mitigated.

    clients SHOULD NOT use the implicit grant (response type token) or other response types issuing access tokens in the authorization response

SHOULD
1

  1. RFC 9700 - Section 2.1.2

    Use `code` or another response type that causes access tokens to be issued in the token response..

    Condition: Instead of using a response type that issues an access token in the authorization response.

    Clients SHOULD instead use the response type code

Client metadata

MUST
1

  1. RFC 7591 - Section 2

    Be the same as the `response_type` value passed to the authorization endpoint..

    Condition: If the authorization endpoint is used by the grant type and RFC 7591 `response_types` metadata is used.

    the value of this parameter MUST be the same as the value of the "response_type" parameter

Authorization servers

MUST
1

  1. RFC 6749 - Section 3.1.1

    Return an authorization error response..

    Condition: If the authorization request omits `response_type` or the response type is not understood.

    the authorization server MUST return an error response as described in Section 4.1.2.1.

Response types

MUST
1

  1. RFC 6749 - Section 8.4

    Conform to the `response-type` ABNF..

    Condition: When defining or registering the response type.

    Response type names MUST conform to the response-type ABNF.

MAY
1

  1. RFC 6749 - Section 3.1.1

    Contain a space-delimited list of values whose order does not matter..

    Condition: When defining a composite response type.

    Extension response types MAY contain a space-delimited (%x20) list of values.

Validation Guidance

error

Require the decoded authorization request to contain a `response_type` whose components are exactly `code`, `id_token`, and `token`; accept any ordering of that set.

error

Return an authorization error when this response type is unsupported or not understood.

error

Validate the decoded value against the RFC 6749 `response-type` ABNF: nonempty ALPHA, DIGIT, or `_` components separated by SP characters.

error

When RFC 7591 client metadata is enforced, ensure the client's `response_types` metadata permits the response type used in the authorization request.

warning

Flag use of this response type unless access-token injection is prevented and authorization-response token-leakage vectors are mitigated.

warning

Prefer `code` or `code id_token`, with access tokens issued by the token endpoint, over `code id_token token`.

Security Notes

RFC 9700 - Section 2.1.2

This response type returns an access token in the authorization response and is therefore exposed to the access-token leakage and replay risks described for implicit-style responses.

Reference

OAuth 2.0 Multiple Response Type Encoding Practices

Details

Entry Id
code id_token token
Name
code id_token token
Change Controller
OpenID_Foundation_Artifact_Binding_WG
Reference
OAuth 2.0 Multiple Response Type Encoding Practices