Overview#

Hybrid Flow is requested by using a response_type='code id_token'

Hybrid Flow returns an id_token from the authorization_endpoint in addition to the authorization Code and adds a c_hash which enables a check that the authorization Code is valid.

Hybrid Flow follows the following steps:

• OAuth Client prepares an Authentication Request containing the desired request parameters.
• OAuth Client sends the Authentication Request to the Authorization Server.
• Authorization Server Authentication of the End-User.
• Authorization Server Request End-User Consent-Authorization.
• Authorization Server sends the End-User back to the Client with an Authorization Code and, depending on the Response Type, one or more additional parameters.
• OAuth Client requests a response using the Authorization Code at the Token_endpoint.
• OAuth Client receives a response that contains an Id_token and Access_token in the response body.
• OAuth Client validates the Id_token and retrieves the End-User's Subject Identifier.

Authentication Request#

• response_type must be:
  • code id_token
  • code token
  • code id_token token

The following is a non-normative example request using the Hybrid Flow that would be sent by the User Agent to the Authorization Server in response to a corresponding HTTP 302 redirect response by the Client: (with line wraps within values for display purposes only):

  GET /authorize?
    response_type=code%20id_token
    &client_id=s6BhdRkqt3
    &redirect_uri=https%3A%2F%2Fclient.example.org%2Fcb
    &scope=openid%20profile%20email
    &nonce=n-0S6_WzA2Mj
    &state=af0ifjsldkj HTTP/1.1
  Host: server.example.com

Successful OpenID Connect Authentication Response#

These Authorization_endpoint results are used in the following manner:

• access_token - OAuth 2.0 Access Token. This is returned when the response_type value used is code token, or code id_token token. (A token_type value is also returned in the same cases.)
• id_token - This is returned when the response_type value used is "code id_token" or code id_token token.
• code

The following is a non-normative example of a successful response using the Hybrid Flow (with line wraps for the display purposes only):

  HTTP/1.1 302 Found
  Location: https://client.example.org/cb#
    code=SplxlOBeZQQYbYS6WxSbIA
    &id_token=eyJ0 ... NiJ9.eyJ1c ... I6IjIifX0.DeWt4Qu ... ZXso
    &state=af0ifjsldkj

More Information#

• Access Token Validation
• Best Practices OpenID Connect
• Grant Types
• Identity Token
• OAuth 2.0 Protocol Flows
• OAuth 2.0 Vulnerabilities
• OpenID Connect Flows