title: How to refresh an id_token
body: <p>In the <a href="http://openid.net/specs/openid-connect-core-1_0.html#RefreshTokenResponse" rel="nofollow noreferrer">OpenID Connect Core 1.0 incorporating errata set 1 Section 12.2</a> is says:</p>
  
  <pre><code>12.2.  Successful Refresh Response
  
  Upon successful validation of the Refresh Token, the response body is the Token Response of Section 3.1.3.3 except that it might not contain an id_token.
  </code></pre>
  
  <p>Originally when the id_token is acquired, it is a signed, and perhaps encrypted, JWT.
  The id_token is then forward to other services within the same security domain. 
  These other services require an assurance that the end-user has authenticated the request. 
  This works well on the original request.
  However, in the refresh scenario, and if the id_token is expired, the "other services" have no method to confirm the user.</p>
  
  <p>Sure the same information is available at the user info endpoint but this requires the "other services" to obtain the access token.
  Based on the least principle principals the Access Token has more privileges  than the id_token being forwarded.</p>
  
  <p>The only other option I am aware of is to copy the id_token into another JWT and send it but this is of course more "make work".</p>
  
  <p>It seems to me that NOT returning an id_token is an issue if there were not scope changes from the original request.</p>