why id_token is passed via url with fragment identifier instead query string?

Question

After the openid authentication, id_token (jwt) is passed to the client is through URI fragment instead of query string which makes impossible to read by the server. Whats the real motto behind this. Whats the benefits out of this

Answer 1

The fragment is supposed to be stripped by the user agent (e.g. browser) before loading the URL so the fragment doesn't end up in server side logs.

One should be aware that recent changes in browser implementations make the assumption above questionable and it may be safer to rely on an Authorization Code flow.