AuthN/AuthZ when accessing protected resource directly with a web browser

We have a related issue https://github.com/solid/solid-oidc/issues/31

We discussed it again today during AuthN meeting and decided that we should circulate it here first. /cc @acoburn

We need to clarify if we want to support direct access with a web browser, so the resource URL would appear in the address bar. When it comes to Solid-OIDC in particular, this would require Solid Storage to implement Solid-OIDC client. Storage in this particular case would play the role of OAuth Client and not OAuth Resource Server (no Access Token comes into play, just the ID Token).

Among various nuances of this scenario, we would need to clarify various security considerations, especially that Storage acting as OAuth Client would most likely use cookies to establish session in the web browser. For example, other clients running in a browser shouldn't be able to circumvent their restriction by using that cookie and getting access as if there were the storage itself.

Once we clarify general requirements motivated by this use case, we will also need to decide where we should specify that Solid Storage needs to implement Solid-OIDC Client, besides implementing Solid-OIDC Resource Server.

I included AuthZ in the title since we will need to include it as well. We currently move towards having the default no access for any client unless explicitly allowed. If storage acts as the client we should also consider if it needs explicit authorization or we will rely on implicit authorization if storage itself acts as the OAuth client (Solid-OIDC).

Start with related issue #31 and the linked AuthN meeting note on accessing non-RDF sources directly via a browser. Clarify the browser-access, cookie, client restriction, and authorization requirements, then document the decision about where Solid Storage's Solid-OIDC client requirement belongs.