Something about Apple's decision to do "OAuth-but-not-quite" rubbed me the wrong way, but this is a great example of how it breaks down very concretely.
This tweet is unavailable

Aug 19, 2019 · 9:29 PM UTC

2
3
8
Replying to @aaronpk
This is disappointing, and likely a hole in any OIDC compliance. I'd expect requesting an email scope drops the email claim into the token.
1
100%. Also notice how not following the spec opened up a new vulnerability. But when has Apple been known to respect standards?
1
more replies
Replying to @aaronpk
IIRC, incompatibilities between implementations sank OpenID. Hence the problem is in the programmers, again.
This tweet is unavailable
Yeah totally. That was why I was bashing my head against the wall for a while when I first tried this API out. I couldn't figure out what I was doing wrong. The worst part is it's based on the first time the user approves the app regardless of whether the app finishes the flow.