Search code examples
oauthopenid-connectimplicitform-post

OIDC response_mode= form_post


I am implementing the response_mode=form_post and I would like to know what are the possible response_types for this mode.

I read in some places that it supports response_type=code, response_type=id_token. (Login only cases). When access_token is returned, with type id_token token ,can we use form_post?


Solution

  • You can have any response type used with the form_post response mode. The specification defines default response modes that should be used with the given response types, but the spec for form_post does not limit its use to only some response_type cases.

    Still, that should not make any difference for your implementation. You should just take the form returned by the authorization server and submit it, like you would any other HTML form on a page. So it doesn't matter for you what is in the form, and the action URL should be in the form anyway.