paul-hicks-nz

OAuth2 request_type="code" scope="openid ..." is spuriously validating id_token

2

I'm getting a validation error with a response from a plain OAuth2 (non-OIDC) AS. The request_type is "code" and I have the "openid" scope included. Line 43 of ResponseValidator is...

Potential loss of information when failing to get a token

2

I've come across a response from a request('tokenEndpoint') which includes a property in the response body that OAuth2Client is ignoring. I've checked the RFC, and there's no "MUST NOT" or...