OAuth 2.0 Form Post Response Mode

[TakahikoKawasaki]

OAuth 2.0 Form Post Response Mode support.

Form Post Response Mode (aka response_mode=form_post) has a considerably big impact on authorization server implementations. It is recommended that the feature be designed and implemented from the beginning.

[jgrandja]

@TakahikoKawasaki I'm curious which well-known OIDC providers have implemented this? Are you able to provide me a list of providers?

[TakahikoKawasaki]

Not limited to but at least the certified OPs whose "Form Post OP" column is checked support OAuth 2.0 Form Post Response Mode.

[sjohnr]

See this minimal implementation as a starting point.

[littlefisher666]

Is there any plan to support response_mode?

[erlendfg]

One of our IdP requires that form_post is being used, so I wonder why this issue has been closed. Is it because no list of IdPs have been posted?

I posted the following on Stackoverflow for a couple of days ago, and now I understand why it's not possible to set this value for response_mode:
https://stackoverflow.com/questions/79326767/response-mode-form-post-triggers-invalid-csrf-token-in-spring-auth-server

Here are two Norwegian IdPs which support form_post, and the latter almost requires this mode:

• ID-porten: https://idporten.no/.well-known/openid-configuration
• Helsenorge: https://eksternapi.helsenorge.no/sts/oidcprov/v3/.well-known/openid-configuration