Something about Apple's decision to do "OAuth-but-not-quite" rubbed me the wrong way, but this is a great example of how it breaks down very concretely.
This tweet is unavailable
2
3
8
This is disappointing, and likely a hole in any OIDC compliance. I'd expect requesting an email scope drops the email claim into the token.
1
Replying to @hpsin_
100%. Also notice how not following the spec opened up a new vulnerability. But when has Apple been known to respect standards?

Aug 19, 2019 · 10:48 PM UTC

1
Replying to @aaronpk
I'll say that compliance is sometimes a journey, and the OIDC community and developers are both great at cheering on and supporting those who want to put in the work to join the fold. Given the privacy implications, I trust that this can be remedied after some thought and effort.
1