After the openid authentication, id_token (jwt) is passed to the client is through URI fragment instead of query string which makes impossible to read by the server. Whats the real motto behind this. Whats the benefits out of this
The fragment is supposed to be stripped by the user agent (e.g. browser) before loading the URL so the fragment doesn't end up in server side logs.
One should be aware that recent changes in browser implementations make the assumption above questionable and it may be safer to rely on an Authorization Code flow.
Collected from the Internet
Please contact [email protected] to delete if infringement.
Comments