Question

My question is pretty simple:

If you have two web-application components:

1. Server-side (secret-capable) code in PHP, Python, Perl … whatever
2. The javascript output and interpreted by the browser

Given a single redirection to the authorisation endpoint (and back) is it possible to specify and transfer the information for:

1. An authorization code grant (for the server-side code)
2. An implicit grant with restricted rights for the Javascript

thereby transferring the two grants (one in the request-url proper and the other in the fragment) in one round-trip without violating the RFC?

One redirect-loop seems cleaner than one for each grant (even if the second doesn’t block due to previous authorization)

Thanks in advance!

References

1. https://datatracker.ietf.org/doc/html/draft-ietf-oauth-v2-16#section-4.2

edit 1: code_and_token seems to be the type of thing I am after … an auth code grant for the server to request the access code using its credentials … and an implicit token for the javascript. As mov matake mentions, it was pulled from the RFC after v11, with no real note as to why. Facebook and Google seem to support this which makes me suspect it will return.

Answer 1

The token_and_code request type was removed from the specification because it needed significant work in terms of security analysis and rules, and no one offered to do it. It was originally proposed by a Twitter engineer who left the working group shortly after.

It will not be added to the specification, but it can easily be introduced by an extension. Google supported this flow on the list, but later said they will not implement it, and instead, will implement something else using HTML5 features.