Skip to content

Support POST on /oidc/authorize endpoint #263

@tvdijen

Description

@tvdijen

We have a client that has its AuthRequests hardcoded to use HTTP POST instead of HTTP GET.
This is currently not supported by this library, leading to the following exception:

{"timestamp":"2025-06-24T11:36:51.548+00:00","status":405,"error":"Request method 'POST' not supported","path":"/oidc/authorize","error_description":"Request method 'POST' not supported","message":"Request method 'POST' not supported"}

The specifications however demand that both methods are accepted:
https://openid.net/specs/openid-connect-core-1_0.html#AuthRequest

Quoting:

3.1.2.1. Authentication Request
An Authentication Request is an OAuth 2.0 Authorization Request that requests that the End-User be authenticated by the Authorization Server.

Authorization Servers MUST support the use of the HTTP GET and POST methods defined in RFC 7231 [RFC7231] at the Authorization Endpoint. Clients MAY use the HTTP GET or POST methods to send the Authorization Request to the Authorization Server. If using the HTTP GET method, the request parameters are serialized using URI Query String Serialization, per Section 13.1. If using the HTTP POST method, the request parameters are serialized using Form Serialization, per Section 13.2.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    Status

    New

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions