Mention response_mode=fragment in 4.1.2

[will-bartlett]

Microsoft Entra supports response_mode=fragment from https://openid.net/specs/oauth-v2-multiple-response-types-1_0.html. Microsoft Entra's browser-based apps library (https://github.com/AzureAD/microsoft-authentication-library-for-js) uses this mode with the authorization code flow. The draft says:

Additionally, implicit clients can be subject to a further kind of attack.

It would be nice to clarify that both implicit clients and non-implicit clients using providers that support response_mode=fragment can be subject to this attack.

[will-bartlett]

See also oauth-wg/oauth-browser-based-apps#52 for why I care about this. Performant browser-based apps prefer response_mode=fragment with the authorization code flow.

[danielfett]

Thanks, I added this to the existing PR: https://github.com/oauthstuff/draft-ietf-oauth-security-topics/pull/96/files#diff-77ee9ab27bcd9251f5eb325749ff9ffc20ba0cdc7405ad3c8a7807ed8d529c43R109