-
-
Notifications
You must be signed in to change notification settings - Fork 535
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
What is a hybrid application #543
Comments
#475 should put you on the right track. |
Great - i think i understand a bit more - i`ve ready in other issues or commits that the authorizationCode flow is supported without secrets and pkce. Is that in the a confidential, hybrid or public app ? |
Public. Hybrid apps can use the code flow, but they must use their client secret to communicate with the token endpoint. |
Thanks so much for the quick answers, this is a great project but making the right config choices is not always clear... |
Thanks for the kind words.
I agree. That's why putting effort into the documentation is essential. There's an ticket for the client type docs: openiddict/openiddict-documentation#7. Would you be interested in contributing? |
What is a hybrid application ?
I can't seem to find what it does by reading the code...
From my understanding:
confidential apps : apps with a client secret that MUST be provided and flows fail if they don't require a client secret (i.e. implicit flow). What about AuthorizationCode flow with pkce that doesn't require a client secret - how are those defined ?
public apps apps without a client secret and flows fail if they require de client secret. Is this where AuthorizationCode flow without client secret fits in ?
hybrid : ???
Thanks !
The text was updated successfully, but these errors were encountered: