Response type "none" seems to not be supported

[mitar]

Is your feature request related to a problem? Please describe.

It seems the edge case response type "none" is not implemented/supported? I checked that by looking at the code. Nor I have found any test trying to test for this case.

Describe the solution you'd like

That support for "none" response type is implemented.

Additional context

Spec: https://openid.net/specs/oauth-v2-multiple-response-types-1_0.html#none

[aeneasr]

Do you have an actual use case for this?

[mitar]

One is described in the spec:

One scenario is where a user wishes to purchase an application from a market, and desires to authorize application installation and grant the application access to Protected Resources in a single step. However, since the user is not presently interacting with the (not yet active) application, it is not appropriate to return access credentials simultaneously in the authorization step.

I am in fact working on a system which is similar, just that it provides access to datasets, but which might not yet have been uploaded.

[aeneasr]

Ok, contributions welcome!

[aeneasr]

I am closing this issue as it has not received any engagement from the community or maintainers in a long time. That does not imply that the issue has no merit. If you feel strongly about this issue

• open a PR referencing and resolving the issue;
• leave a comment on it and discuss ideas how you could contribute towards resolving it;
• open a new issue with updated details and a plan on resolving the issue.

We are cleaning up issues every now and then, primarily to keep the 4000+ issues in our backlog in check and to prevent maintainer burnout. Burnout in open source maintainership is a widespread and serious issue. It can lead to severe personal and health issues as well as enabling catastrophic attack vectors.

Thank you to anyone who participated in the issue! 🙏✌️