# OpenID Connect Plugin Refactor (OIDC Implicit Flow)

**URL:** https://meta.discourse.org/t/openid-connect-plugin-refactor-oidc-implicit-flow/386884
**Category:** Development
**Created:** [October 28, 2025, 12:19am UTC](https://meta.discourse.org/t/openid-connect-plugin-refactor-oidc-implicit-flow/386884 "2025-10-28T00:19:52Z")
**Posts on this page:** 1
**Showing post:** 2

<div class="post-metadata">

### Author: ![david](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/david/32/157490_2.png) [@david](https://meta.discourse.org/u/david)
#### Post date: [October 29, 2025, 1:00pm UTC](https://meta.discourse.org/t/openid-connect-plugin-refactor-oidc-implicit-flow/386884/2 "2025-10-29T13:00:26Z")

</div>

I think what you’re describing here is the OpenID Connect [“Implicit Flow”](https://openid.net/specs/openid-connect-core-1_0.html#ImplicitFlowAuth), which works without any server-\>server communication, and therefore doesn’t need a shared secret. Instead, all information is transmitted via the HTTP redirects, and the ID token is cryptographically verified using the public keys from the Discovery Document.

That’s fine, and I think it’s a valid feature request. But it’s a very different system to our current plugin, which uses [the authorization code flow](https://openid.net/specs/openid-connect-core-1_0.html#CodeFlowAuth). This flow uses server-\>server communication with a shared secret, and therefore no cryptographic verification of the id\_token is needed. This is simpler in some ways, but more complex in others.

Importantly: we can’t just change the default implementation in the plugin. Sites which are using the authorization-code flow need to keep using that. IIRC many identity providers don’t even support the Implicit Flow.

So I think there are two paths forward here:

1. We add support for the “implicit flow” in the OIDC plugin, but make it an **opt-in** thing. I think it’s unlikely we’ll accept a PR which introduce the openid-connect gem as a dependency of Discourse core, so therefore it would need to be implemented within our current strategy.

or alternatively

1. You build the implicit flow as a totally new plugin. In this case you’d be free to do whatever you like in terms of implementation (but you’d also have to maintain it yourself)

---

_[View the full topic](https://meta.discourse.org/t/openid-connect-plugin-refactor-oidc-implicit-flow/386884)._