-
Notifications
You must be signed in to change notification settings - Fork 5
Description
We have a client that has its AuthRequests hardcoded to use HTTP POST instead of HTTP GET.
This is currently not supported by this library, leading to the following exception:
{"timestamp":"2025-06-24T11:36:51.548+00:00","status":405,"error":"Request method 'POST' not supported","path":"/oidc/authorize","error_description":"Request method 'POST' not supported","message":"Request method 'POST' not supported"}
The specifications however demand that both methods are accepted:
https://openid.net/specs/openid-connect-core-1_0.html#AuthRequest
Quoting:
3.1.2.1. Authentication Request
An Authentication Request is an OAuth 2.0 Authorization Request that requests that the End-User be authenticated by the Authorization Server.
Authorization Servers MUST support the use of the HTTP GET and POST methods defined in RFC 7231 [RFC7231] at the Authorization Endpoint. Clients MAY use the HTTP GET or POST methods to send the Authorization Request to the Authorization Server. If using the HTTP GET method, the request parameters are serialized using URI Query String Serialization, per Section 13.1. If using the HTTP POST method, the request parameters are serialized using Form Serialization, per Section 13.2.
Metadata
Metadata
Assignees
Labels
Type
Projects
Status