Explicit typing

[panva]

What is a specific ID Token typ: "dpop+id_token" needed for? From a cursory look at two AS implementations implementations this requirement mandates disproportial effor to its (at least for me) perceived benefit.

[dickhardt]

explicit JWT typing is a BCP
https://www.rfc-editor.org/rfc/rfc8725.html#name-use-explicit-typing

id_tokens were defined before the BCP -- I'm following current best current practice ... but I don't have a strong opinion on this

[panva]

Since this isn't defining a new JWT but just adding claims to it I don't think the BCP needs to apply.

If this started a pattern then I cannot imagine how multiple extensions with their explicit ID Token strong types would interact when used together.