Flow example - implicit flow about oidc HOT 3 CLOSED

Hey @zarkoc

First of all: Thanks for the issue.
There seems to be an error in the readme. As you mentioned, we use the oauth2 module which does not support the implicit flow.

Is there any reason why you need to use the implicit flow?

Because IMHO there is no need to support it. The implicit grant was designed for OAuth public clients, which were not able to store a secret. So as a confidential web application there's no need to use it. For various security reasons OAuth2 best current practice proposes to use PKCE instead and OAuth 2.1 will drop it from the specs.

from oidc.

As far as I can see we can't modify the responce_type from code?
The relyingParty struct is using oauthConfig *oauth2.Config, which comes from the oauth2 module, and the code responce_type is hardcoded there.
https://cs.opensource.google/go/x/oauth2/+/6b3c2da3:oauth2.go;l=154

But the readme.md in the Features section explicitly mentions that is supports the ImplicitFlow for RP, so I guess Im missing something?

Thanks,
Zarko

from oidc.

Hi there let me check this tomorrow 😎

cc @livio-a @fgerschwiler

from oidc.