Skip to content

Missing response_mode parameter in API Explorer /authorize docs #10021

@eatplaysleep

Description

@eatplaysleep

Description

Authorization Code Flow API Explorer is missing response_mode parameter.

response_mode (Optional) How the result of the authorization request is formatted. Values:
  • query - for Authorization Code grant. 302 Found triggers redirect.
  • fragment - for Implicit grant. 302 Found triggers redirect.
  • form_post - 200 OK with response parameters embedded in an HTML form as hidden parameters.
  • web_message - For Silent Authentication. Uses HTML5 web messaging.

...

The OAuth 2.0 Multiple Response Type Encoding Practices specification added a parameter that specifies how the result of the authorization request is formatted. This parameter is called response_mode. It is optional and can take the following values:

Value Description
query This is the default for Authorization Code grant. A successful response is 302 Found which triggers a redirect to the redirect_uri. The response parameters are embedded in the query component (the part after ?) of the redirect_uri in the Location header.For example:HTTP/1.1 302 FoundLocation: https://my-redirect-uri.callback?code=js89p2x1 where the authorization code is js89p21.
fragment This is the default for Implicit grant. A successful response is 302 Found, which triggers a redirect to the redirect_uri (which is a request parameter). The response parameters are embedded in the fragment component (the part after #) of the redirect_uri in the Location header.For example:HTTP/1.1 302 FoundLocation: https://my-redirect-uri/callback#access_token=eyB...78f&token_type=Bearer&expires_in=3600.
form_post The response mode is defined by the OAuth 2.0 Form Post Response Mode specification. A successful response is 200 OK and the parameters are embedded in an HTML form as hidden params. The action of the form is the redirect_uri and the onload attribute is configured to submit the form. After the HTML is loaded by the browser, a redirect to the redirect_uri is done.
web_message This response mode is defined in OAuth 2.0 Web Message Response Mode specification. It uses HTML5 Web Messaging instead of the redirect for the authorization response from the /authorization endpoint. This is particularly useful when using Silent Authentication. To do this response mode, you must register your app's URL at the Allowed Web Origins field in your Auth0 application settings.

See Authorization Endpoint docs.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions