search

IdentityModel / oidc-token-manager

Apache License 2.0
51 stars 36 forks source link

AuthorizationCode flow #52

Closed jasonhjohnson closed 8 years ago

jasonhjohnson commented 8 years ago

Hi,

Is there any way to request a "code" only rather than having to require a token or id_token? I'd like to only return the authorization code.

Thanks, Jason

brockallen commented 8 years ago

For a browser based JS client?

jasonhjohnson commented 8 years ago

Yes. Maybe I don't understand flows. I just want the code returned rather than all the extra profile information.

brockallen commented 8 years ago

Code flow is for mobile/desktop and server-side apps (if needed). Browser-based JS apps use the implicit flow, which is why that's all this library supports.

jasonhjohnson commented 8 years ago

Well my client-side app is hosted within a .NET Core application - could I perhaps get just the code via .NETand save to client for it's use? A different question if that's outside the scope of this forum would be how I can not have all the profile info returned in the token.

brockallen commented 8 years ago

If the client is a server-side MVC app and you want to use the token from the server code, then you could use the OIDC middleware to obtain the token(s), and then you'd not need this library.

If you only use it from the client side code, then you could still use this library, but it would be implicit flow.