title: Open ID Connect and native public app...no implicit flow, no hybrid flow...so what?
body: <p>We are currently developing a native mobile application, and we need to authenticate end-user with our identity server (made with thinktecture identity server v3), and/or external social identity providers, 
  to consume some resources in our system.</p>
  
  <p>We are trying to use OIDC to obtain access token and id token.
  In a perfect world, <strong>we want that native mobile application end-user remains logged indefinitely</strong> (even across native app reboots) until end-user decides to logoff.</p>
  
  <p>So first, we have selected implicit flow. 
  But we have discovered that refresh tokens are NOT available in this flow.</p>
  
  <p><strong>1. why implicit flow spec forbids refresh tokens ? where is the
      danger ?</strong></p>
  
  <p><strong>2. To say it in other words, why token endpoint is not “reachable” with implicit flow ?</strong></p>
  
  <p>Then, we have tested hybrid flow to obtain refresh tokens (very very long-lived but revocable) and access token (short-lived). 
  The problem is to embed a client_secret into a native public client. (bad and insecure practice as described by the OIDC specs)</p>
  
  <p><strong>3)    So…native public app cannot use hybrid flow…huh?</strong></p>
  
  <p>So, we are currently wondering if a custom code flow solution is a good idea:
  Make a "proxy"/"front-end" web api  that can reach the token end-point with his own secured client_secret 
  and so, relays the code/refresh_token/access_token requests from the native client app to the authorization server token endpoint?</p>
  
  <p><a href="http://s11.postimg.org/8zotb4uib/code_flow_with_proxy.png" rel="nofollow">custom code flow picture</a></p>
  
  <p><strong>4)    Any comments about this ?</strong></p>