From 1731efb8f0e47a9bae020f8f3e7102c05797b255 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?K=C3=A9vin=20Chalet?= <kevinchalet@gmail.com>
Date: Mon, 10 Jul 2023 17:26:39 +0200
Subject: [PATCH] Bring back the code comment indicating why
 response_type=token is never negotiated

---
 src/OpenIddict.Client/OpenIddictClientHandlers.cs | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/src/OpenIddict.Client/OpenIddictClientHandlers.cs b/src/OpenIddict.Client/OpenIddictClientHandlers.cs
index cbafdd66..02c64733 100644
--- a/src/OpenIddict.Client/OpenIddictClientHandlers.cs
+++ b/src/OpenIddict.Client/OpenIddictClientHandlers.cs
@@ -4227,6 +4227,15 @@ public static partial class OpenIddictClientHandlers
 
                     => (GrantTypes.Implicit, ResponseTypes.IdToken + ' ' + ResponseTypes.Token),
 
+                // Note: response_type=token is not considered secure enough as it allows malicious
+                // actors to inject access tokens that were initially issued to a different client.
+                // As such, while OpenIddict-based servers allow using response_type=token for backward
+                // compatibility with legacy clients, OpenIddict-based clients are deliberately not
+                // allowed to negotiate the unsafe and OAuth 2.0-only response_type=token flow.
+                //
+                // For more information, see https://datatracker.ietf.org/doc/html/rfc6749#section-10.16 and
+                // https://datatracker.ietf.org/doc/html/draft-ietf-oauth-security-topics-19#section-2.1.2.
+
                 // None flow with response_type=none.
                 (var client, var server) when
                     // Ensure response_type=none is supported.