As the sibling comment says: not just that it's a string, but which strings are expected. OIDC extends the list with a few more: https://openid.net/specs/openi

As the sibling comment says: not just that it's a string, but which strings are expected. OIDC extends the list with a few more: https://openid.net/specs/openid-connect-core-1_0.html#AuthError https://openid.net/specs/openid-connect-core-1_0.html#AuthEr... This allows clients to interop with any server. Doing the shit Facebook is doing completely ignores one of the main objectives of implementing a RFC: interoperability.