Skip to main content

FlowTypes Enum

Abblix.Oidc.Server​

Abblix.Oidc.Server.Common.Constants​

FlowTypes Enum​

Represents OAuth 2.0 flow types.

public enum FlowTypes

Fields​

AuthorizationCode 1​

When using the Authorization Code Flow, all tokens are returned from the Token Endpoint. The Authorization Code Flow returns an Authorization Code to the Client, which can then exchange it for an ID Token and an Access Token directly. This provides the benefit of not exposing any tokens to the User Agent and possibly other malicious applications with access to the User Agent. The Authorization Server can also authenticate the Client before exchanging the Authorization Code for an Access Token. The Authorization Code flow is suitable for Clients that can securely maintain a Client Secret between themselves and the Authorization Server.

Remarks​

https://openid.net/specs/openid-connect-core-1\_0.html\#CodeFlowAuth

Implicit 2​

When using the Implicit Flow, all tokens are returned from the Authorization Endpoint; the Token Endpoint is not used. The Implicit Flow is mainly used by Clients implemented in a browser using a scripting language. The Access Token and ID Token are returned directly to the Client, which may expose them to the End-User and applications that have access to the End-User's User Agent. The Authorization Server does not perform Client Authentication.

Remarks​

https://openid.net/specs/openid-connect-core-1\_0.html\#ImplicitFlowAuth

Hybrid 3​

When using the Hybrid Flow, some tokens are returned from the Authorization Endpoint and others are returned from the Token Endpoint. The mechanisms for returning tokens in the Hybrid Flow are specified in OAuth 2.0 Multiple Response Type Encoding Practices.

Remarks​

https://openid.net/specs/openid-connect-core-1\_0.html\#HybridFlowSteps

None 4​

The none response type flow (OAuth 2.0 Multiple Response Type Encoding Practices §4): the authorization request runs to completion but the response carries no authorization code and no tokens. A distinct non-zero value so it never collides with default(FlowTypes), which the flow detector uses as its "no flow detected" sentinel; it does not combine with the token-part flags above.