Summary
Add support for response_mode=form_post as defined in OAuth 2.0 Form Post Response Mode. Currently only response_mode=query (default) is supported.
Current Behavior
response_mode=query works (authorization code returned as a query parameter in the redirect URI)response_mode=form_post is not supported — requests using it are ignored or rejected- The well-known discovery document does not advertise
response_modes_supported
Proposed Changes
- When
response_mode=form_post is requested, the authorization endpoint should return an auto-submitting HTML form that POSTs the authorization response (code, state) to the redirect URI instead of redirecting with query parameters
- Advertise
response_modes_supported: ["query", "form_post"] in the discovery document
- Validate that
response_mode is one of the supported values
The HTML response is a simple self-submitting form:
<html><body onload="document.forms[0].submit()">
<form method="post" action="{{redirect_uri}}">
<input type="hidden" name="code" value="{{code}}"/>
<input type="hidden" name="state" value="{{state}}"/>
</form>
</body></html>Why
- Practical need — some server-side web frameworks and SPAs prefer form_post to avoid leaking the authorization code in browser history and referrer headers
- OIDC conformance — some conformance test plans test form_post support
- Low complexity — one additional code path in the authorize handler, a small HTML template, no new infrastructure
References
Summary
Add support for
response_mode=form_postas defined in OAuth 2.0 Form Post Response Mode. Currently onlyresponse_mode=query(default) is supported.Current Behavior
response_mode=queryworks (authorization code returned as a query parameter in the redirect URI)response_mode=form_postis not supported — requests using it are ignored or rejectedresponse_modes_supportedProposed Changes
response_mode=form_postis requested, the authorization endpoint should return an auto-submitting HTML form that POSTs the authorization response (code,state) to the redirect URI instead of redirecting with query parametersresponse_modes_supported: ["query", "form_post"]in the discovery documentresponse_modeis one of the supported valuesThe HTML response is a simple self-submitting form:
Why
References