Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

response_mode in authorization code flow #396

Closed
uta-pmizilin opened this issue Aug 24, 2021 · 3 comments · Fixed by #469
Closed

response_mode in authorization code flow #396

uta-pmizilin opened this issue Aug 24, 2021 · 3 comments · Fixed by #469

Comments

@uta-pmizilin
Copy link

Is form_post response_mode supported for authorization code flow (ConfidentialClientApplication)?
Looking at application.py it seems like response_mode parameter is not implemented at all.

msal==1.13.0

@rayluo
Copy link
Collaborator

rayluo commented Aug 24, 2021

It is true that MSAL Python does not currently expose the response_mode parameter, because the use of response_mode parameter was "not recommended" per the original specs. But we can add it, per newer guidance.

Marking this issue as an enhancement.

@uta-pmizilin
Copy link
Author

uta-pmizilin commented Aug 24, 2021

@rayluo Thanks for the quick response; I assume the newer guidance is the reason why https://docs.microsoft.com/en-us/azure/active-directory/develop/v2-protocols-oidc recommends form_post for web applications:

response_mode - Recommended
Specifies the method that should be used to send the resulting authorization code back to your app. Can be form_post or fragment. For web applications, we recommend using response_mode=form_post, to ensure the most secure transfer of tokens to your application.

@ndrsn
Copy link

ndrsn commented Apr 14, 2022

Has any progress been made on this issue?

If not, would a pull request implementing response_mode be welcome, and would you have any pointers as to where to start — based on a cursory glance through the code, it looks like initiate_auth_code_flow would be the place to add/support this parameter?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging a pull request may close this issue.

3 participants