OAuth 2.0 Form Post Response Mode

[TakahikoKawasaki]

OAuth 2.0 Form Post Response Mode support.

Form Post Response Mode (aka response_mode=form_post) has a considerably big impact on authorization server implementations. It is recommended that the feature be designed and implemented from the beginning.

[jgrandja]

@TakahikoKawasaki I'm curious which well-known OIDC providers have implemented this? Are you able to provide me a list of providers?

[TakahikoKawasaki]

Not limited to but at least the certified OPs whose "Form Post OP" column is checked support OAuth 2.0 Form Post Response Mode.

[sjohnr]

See this minimal implementation as a starting point.

[littlefisher666]

Is there any plan to support response_mode?

[erlendfg]

One of our IdP requires that form_post is being used, so I wonder why this issue has been closed. Is it because no list of IdPs have been posted?

I posted the following on Stackoverflow for a couple of days ago, and now I understand why it's not possible to set this value for response_mode:
https://stackoverflow.com/questions/79326767/response-mode-form-post-triggers-invalid-csrf-token-in-spring-auth-server

Here are two Norwegian IdPs which support form_post, and the latter almost requires this mode:

• ID-porten: https://idporten.no/.well-known/openid-configuration
• Helsenorge: https://eksternapi.helsenorge.no/sts/oidcprov/v3/.well-known/openid-configuration

[areguru]

I would like to add some context to the previous comment.

ID-porten is the common IDP for Norwegian public services, and is operated by the Norwegian Digitalisation Agency (Digdir). It is used for instance by the "Norwegian Labour and Welfare Administration".

Helsenorge is the National online health services in Norway.

Both welfare administation and medical information services are of course considered particularly sensitive, and an eID with the highest security level is required.

Form Post response mode was introduced to address security concerns related to encoding response values in the default query response mode, which sends the response parameters as a part of the redirect URL.

Form Post Response Mode is sending response parameters in the body of an HTTP POST request. This prevents sensitive data from being stored in HTTP logs, referral headers, or browser histories, reducing the risk of data leakage.

What is the reasoning for not implementing this?