What is the purpose of claims request parameter on OAuth 2.0?
<p>OpenID specification 5.5 explain RP can request claims using claims request parameter. <a href="http://openid.net/specs/openid-connect-core-1_0.html#ClaimsParameter" rel="nofollow">http://openid.net/specs/openid-connect-core-1_0.html#ClaimsParameter</a></p>

<p>What is the purpose of this feature?</p>

<p>Is it this feature create security vulnerabilities as user able to set claims?</p>

<p>For example user can modify URL on browser into:</p>

<pre><code>https://op.example.com/authorize?
response_type=code
&amp;client_id=client
&amp;redirect_uri=https://client.example.com
&amp;scope=openid
&amp;claims={“userinfo” : {“sub”: { “value” : “superuser”}} , “id_token” : {“sub”: { “value” : “superuser” }}}
</code></pre>

<p>If OP implements this feature, then OP put that claims into id token and user info.</p>