An OAuth/OIDC exchange at a route the host owns, so the awaiting happens in JavaScript before PHP
is entered and PHP is handed a decided result.
This is the only route, not a cheaper JSPI: WITH_OPENSSL=0, so the interpreter cannot verify an
RS256 id_token, and the host has crypto.subtle. The claims never travel in a URL; the browser
carries a single-use ticket and the claims sit in the object's storage until first read.
An OAuth/OIDC exchange at a route the host owns, so the awaiting happens in JavaScript before PHP is entered and PHP is handed a decided result.
This is the only route, not a cheaper JSPI:
WITH_OPENSSL=0, so the interpreter cannot verify an RS256id_token, and the host hascrypto.subtle. The claims never travel in a URL; the browser carries a single-use ticket and the claims sit in the object's storage until first read.