Implicit Flow:

The Implicit Flow follows the following steps:

• Client prepares an Authentication Request containing the desired request parameters.

• Client sends the request to the Authorization Server.

• Authorization Server Authenticates the End-User.

• Authorization Server obtains End-User Consent/Authorization.

• Authorization Server sends the End-User back to the Client with an ID Token and, if requested, an Access Token.

• Client validates the ID token and retrieves the End-User's Subject Identifier.

Authentication Request:

GET / authz-srv/authz?
    response_type=id_token%20token
    &client_id=s6BhdRkqt3
    &redirect_uri=https%3A%2F%2Fsamplecreative.com
    &scope=openid%20profile
    &state=af0ifjsldkj
    &nonce=n-0S6_WzA2Mj HTTP/1.1
  Host: samplecreative.com

response_type REQUIRED. OAuth 2.0 Response Type value that determines the authorization processing flow to be used, including what parameters are returned from the endpoints used. When using the Implicit Flow, this value is id_token token or id_token. The meanings of both of these values are defined in OAuth 2.0 Multiple Response Type Encoding Practices [OAuth.Responses]. No Access Token is returned when the value is id_token.

NOTE: While OAuth 2.0 also defines the token Response Type value for the Implicit Flow, OpenID Connect does not use this Response Type, since no ID Token would be returned.

redirect_uri REQUIRED. Redirection URI to which the response will be sent. This URI MUST exactly match one of the Redirection URI values for the Client pre-registered at the OpenID Provider. When using this flow, the Redirection URI MUST NOT use the http scheme unless the Client is a native application, in which case it MAY use the http: scheme with localhost as the hostname.

nonce REQUIRED.String value used to associate a Client session with an ID Token, and to mitigate replay attacks. The value is passed through unmodified from the Authentication Request to the ID Token. Sufficient entropy MUST be present in the nonce values used to prevent attackers from guessing values.

Authentication Response:

HTTP/1.1 302 Found
  Location: https://samplecreative.com
    access_token=SlAV32hkKG
    &token_type=bearer
    &id_token=eyJ0NiJ9.eyJ1c... 
    &expires_in=3600
    &state=af0ifjsldkj

access_token OAuth 2.0 Access Token. This is returned unless the response_type value used is id_token.

token_type OAuth 2.0 Token Type value. The value MUST be Bearer or another token_type value that the Client has negotiated with the Authorization Server. Clients implementing this profile MUST support the OAuth 2.0 Bearer Token Usage [RFC6750] specification. This profile only describes the use of bearer tokens. This is returned in the same cases as access_token is.

id_tokenREQUIRED. ID Token.

state OAuth 2.0 state value. REQUIRED if the state parameter is present in the Authorization Request. Clients MUST verify that the state value is equal to the value of state parameter in the Authorization Request.

expires_in OPTIONAL. Expiration time of the Access Token in seconds since the response was generated.

The contents of the ID Token are as described in Section 2. When using the Implicit Flow, these additional requirements for the following ID Token Claims apply:

nonce Use of the nonce Claim is REQUIRED for this flow.

at_hash Access Token hash value. Its value is the base64url encoding of the left-most half of the hash of the octets of the ASCII representation of the access_token value, where the hash algorithm used is the hash algorithm used in the alg Header Parameter of the ID Token's JOSE Header. For instance, if the alg is RS256, hash the access_token value with SHA-256, then take the left-most 128 bits and base64url encode them. The at_hash value is a case sensitive string.

If the ID Token is issued from the Authorization Endpoint with an access_token value, which is the case for the response_type value id_token token, this is REQUIRED; it MAY NOT be used when no Access Token is issued, which is the case for the response_type value id_token.