{"action":"created","issue":{"url":"https://api.github.com/repos/mitreid-connect/OpenID-Connect-Java-Spring-Server/issues/806","labels_url":"https://api.github.com/repos/mitreid-connect/OpenID-Connect-Java-Spring-Server/issues/806/labels{/name}","comments_url":"https://api.github.com/repos/mitreid-connect/OpenID-Connect-Java-Spring-Server/issues/806/comments","events_url":"https://api.github.com/repos/mitreid-connect/OpenID-Connect-Java-Spring-Server/issues/806/events","html_url":"https://github.com/mitreid-connect/OpenID-Connect-Java-Spring-Server/issues/806","id":71199653,"number":806,"title":"OIDC Behaviour","user":{"login":"VinothrajaJ","id":11550031,"avatar_url":"https://avatars.githubusercontent.com/u/11550031?v=3","gravatar_id":"","url":"https://api.github.com/users/VinothrajaJ","html_url":"https://github.com/VinothrajaJ","followers_url":"https://api.github.com/users/VinothrajaJ/followers","following_url":"https://api.github.com/users/VinothrajaJ/following{/other_user}","gists_url":"https://api.github.com/users/VinothrajaJ/gists{/gist_id}","starred_url":"https://api.github.com/users/VinothrajaJ/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/VinothrajaJ/subscriptions","organizations_url":"https://api.github.com/users/VinothrajaJ/orgs","repos_url":"https://api.github.com/users/VinothrajaJ/repos","events_url":"https://api.github.com/users/VinothrajaJ/events{/privacy}","received_events_url":"https://api.github.com/users/VinothrajaJ/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/mitreid-connect/OpenID-Connect-Java-Spring-Server/labels/Support","name":"Support","color":"c7def8"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":12,"created_at":"2015-04-27T07:16:06Z","updated_at":"2015-05-08T06:45:43Z","closed_at":null,"body":"Once I sucessfully login to my app1 through OIDC through implicit code flow, i receive my tokens(id,access,refresh). \r\nI try to login to app2 through OIDC and follow same steps as above i get differerent sets of tokens(all together).\r\n The issue is I am able to interchangeably use my app 1 access token to get my userInfo from app2. This is also applicable when I try to get access token with refresh token.\r\nAdditionally, when i try to access userinfo with access token from different browser(without even logging in) my OIDC grants me the information.\r\nThere is no session binding between the tokens issued..? are all those behaviour expected.?  "},"comment":{"url":"https://api.github.com/repos/mitreid-connect/OpenID-Connect-Java-Spring-Server/issues/comments/100122657","html_url":"https://github.com/mitreid-connect/OpenID-Connect-Java-Spring-Server/issues/806#issuecomment-100122657","issue_url":"https://api.github.com/repos/mitreid-connect/OpenID-Connect-Java-Spring-Server/issues/806","id":100122657,"user":{"login":"VinothrajaJ","id":11550031,"avatar_url":"https://avatars.githubusercontent.com/u/11550031?v=3","gravatar_id":"","url":"https://api.github.com/users/VinothrajaJ","html_url":"https://github.com/VinothrajaJ","followers_url":"https://api.github.com/users/VinothrajaJ/followers","following_url":"https://api.github.com/users/VinothrajaJ/following{/other_user}","gists_url":"https://api.github.com/users/VinothrajaJ/gists{/gist_id}","starred_url":"https://api.github.com/users/VinothrajaJ/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/VinothrajaJ/subscriptions","organizations_url":"https://api.github.com/users/VinothrajaJ/orgs","repos_url":"https://api.github.com/users/VinothrajaJ/repos","events_url":"https://api.github.com/users/VinothrajaJ/events{/privacy}","received_events_url":"https://api.github.com/users/VinothrajaJ/received_events","type":"User","site_admin":false},"created_at":"2015-05-08T06:45:43Z","updated_at":"2015-05-08T06:45:43Z","body":"My client is registered for authorization code flow , when i pass this request \r\n\r\nPlease clarify this as well..\r\ncase 1\r\nGET /authorize?\r\n    response_type=code%20token\r\n    &client_id=s6BhdRkqt3\r\n    &redirect_uri=https%3A%2F%2Fclient.example.org%2Fcb\r\n    &scope=openid%20profile%20email\r\n    &nonce=n-0S6_WzA2Mj\r\n    &state=af0ifjsldkj HTTP/1.1\r\n  Host: server.example.com\r\n\r\nI get a error message saying client is not registered for implicit grant type.\r\n\r\ncase 2\r\nI make my client to be configured for implicit and authorization code(hybrid)\r\n\r\nnow in my response , i get code,access token and id_token, even though  i requested only for code and access token..\r\n\r\nPLease throw some light above two cases.."}}