Browser-Swapping

[JonasPrimbs]

Added references to OpenID Connect response modes and addressed browser-swapping attack mitigation strategies.

[OllieJC]

Just throwing in another potential mitigation:

• use POSTs with the authorisation endpoint (currently a MAY, could we bump to a SHOULD?)
• auth servers should for a given client allow specifiying expected auth request URI method and then fail if request with another method is used
• use response_mode=form_post
• again, auth servers should allow specifiying expected response_mode and fail if different