-
Notifications
You must be signed in to change notification settings - Fork 1.7k
Open
Description
Description
Authorization Code Flow API Explorer is missing response_mode
parameter.
response_mode
|
(Optional) How the result of the authorization request is formatted. Values:
|
...
The OAuth 2.0 Multiple Response Type Encoding Practices specification added a parameter that specifies how the result of the authorization request is formatted. This parameter is called response_mode
. It is optional and can take the following values:
Value | Description |
---|---|
query | This is the default for Authorization Code grant. A successful response is 302 Found which triggers a redirect to the redirect_uri. The response parameters are embedded in the query component (the part after ?) of the redirect_uri in the Location header.For example:HTTP/1.1 302 FoundLocation: https://my-redirect-uri.callback?code=js89p2x1 where the authorization code is js89p21. |
fragment | This is the default for Implicit grant. A successful response is 302 Found, which triggers a redirect to the redirect_uri (which is a request parameter). The response parameters are embedded in the fragment component (the part after #) of the redirect_uri in the Location header.For example:HTTP/1.1 302 FoundLocation: https://my-redirect-uri/callback#access_token=eyB...78f&token_type=Bearer&expires_in=3600. |
form_post | The response mode is defined by the OAuth 2.0 Form Post Response Mode specification. A successful response is 200 OK and the parameters are embedded in an HTML form as hidden params. The action of the form is the redirect_uri and the onload attribute is configured to submit the form. After the HTML is loaded by the browser, a redirect to the redirect_uri is done. |
web_message | This response mode is defined in OAuth 2.0 Web Message Response Mode specification. It uses HTML5 Web Messaging instead of the redirect for the authorization response from the /authorization endpoint. This is particularly useful when using Silent Authentication. To do this response mode, you must register your app's URL at the Allowed Web Origins field in your Auth0 application settings. |
See Authorization Endpoint docs.
Metadata
Metadata
Assignees
Labels
No labels