code: def openid_authorization_validator(self, request):
          
          request_info = super(HybridGrant, self).openid_authorization_validator(request)
          if not request_info:  # returns immediately if OAuth2.0
              return request_info
  
          # REQUIRED if the Response Type of the request is `code
          # id_token` or `code id_token token` and OPTIONAL when the
          # Response Type of the request is `code token`. It is a string
          # value used to associate a Client session with an ID Token,
          # and to mitigate replay attacks. The value is passed through
          # unmodified from the Authentication Request to the ID
          # Token. Sufficient entropy MUST be present in the `nonce`
          # values used to prevent attackers from guessing values. For
          # implementation notes, see Section 15.5.2.
          if request.response_type in ["code id_token", "code id_token token"]:
              if not request.nonce:
                  raise InvalidRequestError(
                      request=request,
                      description='Request is missing mandatory nonce parameter.'
                  )
          return request_info
docs: Additional validation when following the Authorization Code flow.