Hybrid Flow with OIDC
Learn about the Hybrid Flow, which combines elements of both Authorization Code and Implicit flows for flexibility and security.
Introducing Hybrid Flow
Welcome to the Hybrid Flow! This OIDC flow is a fascinating combination, blending features from both the Authorization Code Flow and the Implicit Flow.
It's designed to offer flexibility, providing some tokens directly via the front-channel (browser redirect) while also enabling the secure acquisition of others via the back-channel.
Why Combine Flows?
Hybrid Flow addresses scenarios where an application needs immediate access to certain identity information (like an ID Token) but also requires the enhanced security of an Authorization Code for obtaining refresh tokens.
- Immediate ID Token: Useful for quick UI updates or initial authentication.
- Secure Access Token/Refresh Token: Obtained via a secure back-channel exchange, preventing token exposure in the browser history.