Method AuthCodeURL oauth2 package doesn't allow explicitly requesting access_token or id_token

[ashish-amarnath]

The oath2 package currently hard-codes the response type to "code". Defaulting the auth server to return only "id_token"
Allowing additional values of "token" and/or "id_token" will let users specify what type of token (id_token or access_token) they would want to receive.

[ericchiang]

Hi @ashish-amarnath,

From my understanding id_token token are largely for the implicit flow, which isn't appropriate for backend applications.

Regardless, AuthCodeURL isn't implemented by this package, it's implemented by golang.org/x/oauth2. You might want to look at golang/oauth2#138

Closing since go-oidc doesn't implement OAuth2 client logic, just ID Token parsing verification.