MB-R261

HUMAN VERIFICATION REQUIRED ASVS 10.6.1 Safe response types (when oauth_oidc is used)

MB-C16 ASVS Level 2 Contextual Human Assurance High

The OpenID Provider only allows values 'code', 'ciba', 'id\_token', or 'id\_token code'for response mode. Note that 'code'is preferred over 'id\_token code'(the OIDC Hybrid flow), and 'token'(any Implicit flow) must not be used.