{"action":"created","issue":{"url":"https://api.github.com/repos/thephpleague/oauth2-server/issues/929","repository_url":"https://api.github.com/repos/thephpleague/oauth2-server","labels_url":"https://api.github.com/repos/thephpleague/oauth2-server/issues/929/labels{/name}","comments_url":"https://api.github.com/repos/thephpleague/oauth2-server/issues/929/comments","events_url":"https://api.github.com/repos/thephpleague/oauth2-server/issues/929/events","html_url":"https://github.com/thephpleague/oauth2-server/issues/929","id":348301592,"node_id":"MDU6SXNzdWUzNDgzMDE1OTI=","number":929,"title":"Alternative Fragment Identifier","user":{"login":"Sephster","id":1457058,"node_id":"MDQ6VXNlcjE0NTcwNTg=","avatar_url":"https://avatars1.githubusercontent.com/u/1457058?v=4","gravatar_id":"","url":"https://api.github.com/users/Sephster","html_url":"https://github.com/Sephster","followers_url":"https://api.github.com/users/Sephster/followers","following_url":"https://api.github.com/users/Sephster/following{/other_user}","gists_url":"https://api.github.com/users/Sephster/gists{/gist_id}","starred_url":"https://api.github.com/users/Sephster/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Sephster/subscriptions","organizations_url":"https://api.github.com/users/Sephster/orgs","repos_url":"https://api.github.com/users/Sephster/repos","events_url":"https://api.github.com/users/Sephster/events{/privacy}","received_events_url":"https://api.github.com/users/Sephster/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":1,"created_at":"2018-08-07T12:35:13Z","updated_at":"2018-08-14T13:14:24Z","closed_at":null,"author_association":"MEMBER","body":"An [old pull request](https://github.com/thephpleague/oauth2-server/pull/801) allowed us to replace the # with an alternative fragment identifier for the implicit grant. I am struggling to find where in the spec this is valid.\r\n\r\nWe need to check if this is valid as it could introduce a security concern should someone use a ? instead, which will convert the params to a query string and make them available to the server.\r\n\r\nThis might be completely valid but it would be good to find out where in the spec it allows this and reference this for future questions."},"comment":{"url":"https://api.github.com/repos/thephpleague/oauth2-server/issues/comments/412867308","html_url":"https://github.com/thephpleague/oauth2-server/issues/929#issuecomment-412867308","issue_url":"https://api.github.com/repos/thephpleague/oauth2-server/issues/929","id":412867308,"node_id":"MDEyOklzc3VlQ29tbWVudDQxMjg2NzMwOA==","user":{"login":"sg3s","id":1511674,"node_id":"MDQ6VXNlcjE1MTE2NzQ=","avatar_url":"https://avatars0.githubusercontent.com/u/1511674?v=4","gravatar_id":"","url":"https://api.github.com/users/sg3s","html_url":"https://github.com/sg3s","followers_url":"https://api.github.com/users/sg3s/followers","following_url":"https://api.github.com/users/sg3s/following{/other_user}","gists_url":"https://api.github.com/users/sg3s/gists{/gist_id}","starred_url":"https://api.github.com/users/sg3s/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/sg3s/subscriptions","organizations_url":"https://api.github.com/users/sg3s/orgs","repos_url":"https://api.github.com/users/sg3s/repos","events_url":"https://api.github.com/users/sg3s/events{/privacy}","received_events_url":"https://api.github.com/users/sg3s/received_events","type":"User","site_admin":false},"created_at":"2018-08-14T13:14:24Z","updated_at":"2018-08-14T13:14:24Z","author_association":"NONE","body":"To be complete; These are features that are in OpenID Connect that are pretty desirable to me:\r\n\r\n- Fragment responses for authorisation requests\r\n- Token introspection\r\n- Token revocation\r\n- Userinfo\r\n- Login / session status through iframe\r\n- Logout flows\r\n\r\nAnd to complete/manage that it also includes:\r\n\r\n- Server discovery (see it as feature detection for clients)\r\n- Server JWK set (publish keys needed to validate tokens)\r\n- Client registration (for dynamic clients, like apps)\r\n\r\nI am not sure what a minimum implementation would be, but server discovery is definitely needed, and some features can be optionally exposed through server discovery."}}
{"actor":{"display_login":"sg3s"}}