Skip to content

Commit a172dd0

Browse files
committed
Update DefaultOsBrowserWebUi.cs
1 parent efffab8 commit a172dd0

File tree

1 file changed

+3
-6
lines changed

1 file changed

+3
-6
lines changed

src/client/Microsoft.Identity.Client/Platforms/Features/DefaultOSBrowser/DefaultOsBrowserWebUi.cs

Lines changed: 3 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -63,7 +63,6 @@ public async Task<AuthorizationResult> AcquireAuthorizationAsync(
6363
{
6464
try
6565
{
66-
// Add response_mode=form_post for security (prevents auth code from appearing in browser history/logs)
6766
var authUriBuilder = new UriBuilder(authorizationUri);
6867
authUriBuilder.AppendOrReplaceQueryParameter(OAuth2Parameter.ResponseMode, "form_post");
6968
authorizationUri = authUriBuilder.Uri;
@@ -87,18 +86,16 @@ public async Task<AuthorizationResult> AcquireAuthorizationAsync(
8786
authResponse.RequestUri.AbsolutePath,
8887
redirectUri.AbsolutePath));
8988
}
90-
91-
// Use FromPostData for form_post responses (more secure - never constructs URI with auth code)
92-
// Use FromUri for legacy GET responses (query string)
9389
if (authResponse.IsFormPost)
9490
{
9591
_logger.Info(() => "[DefaultOsBrowser] Processing form_post response securely from POST data");
9692
return AuthorizationResult.FromPostData(authResponse.PostData);
9793
}
9894
else
9995
{
100-
_logger.Info(() => "[DefaultOsBrowser] Processing legacy GET response from query string");
101-
return AuthorizationResult.FromUri(authResponse.RequestUri.OriginalString);
96+
throw new MsalClientException(
97+
MsalError.AuthenticationFailed,
98+
"The authorization server did not honor response_mode=form_post");
10299
}
103100
}
104101
catch (System.Net.HttpListenerException) // sometimes this exception sneaks out (see issue 1773)

0 commit comments

Comments
 (0)