[OAUTH-WG] -security-topics-13 and OIDC response types + form_post response mode

[Brian Campbell <[e-mail]>]

We have a-sometimes used scenario where a client makes an
authorization/authentication request with a "token id_token" response type
and "form_post" response mode (nonce is also sent and exact redirect URI
matching is done at the AS). The access token is never exposed in any URLs
and access token injection is prevented by the at_hash claim in the id
token.

That seems to me like a legitimate and reasonable usage scenario. However,
it would fall on the wrong side of the SHOULD NOT in Section 3.1.2 of the
Security BCP-to-be
<https://tools.ietf.org/html/draft-ietf-oauth-security-topics-13#section-3.1.2>,
which has:

   In order to avoid these issues, clients SHOULD NOT use the implicit
   grant (response type "token") or any other response type issuing
   access tokens in the authorization response, such as "token id_token"
   and "code token id_token", unless the issued access tokens are
   sender-constrained and access token injection in the authorization
   response is prevented.

I know this particular text has been discussed over and over again so I
hate to revisit it. But based on the aforementioned scenario I think maybe
it still doesn't quite hit the mark. Access token injection is prevented.
The token leakage scenarios mentioned in that section are all avoided. And
while I know sender-constrained is recommended elsewhere in the draft, it's
not really a realistic option for the majority of deployments.

-- 
_CONFIDENTIALITY NOTICE: This email may contain confidential and privileged 
material for the sole use of the intended recipient(s). Any review, use, 
distribution or disclosure by others is strictly prohibited.  If you have 
received this communication in error, please notify the sender immediately 
by e-mail and delete the message and any file attachments from your 
computer. Thank you._