Auto-post OIDC authorization response?

[B]

Hi,

Can the OIDC plugin be configured to return the last response from profile/oidc/authorize as HTML with a form that automatically posts the authorization code and state parameters to the relying party?

This would be similar to how the IdP returns SAML assertions to the browser, with Javascript that submits the form when the document's loaded.

As we have it deployed, the OIDC response is an HTTP 302 redirect, which Chrome blocks. We're required to have a form-action element in our content security policy and we don't want to solve this by managing and disclosing every RP's host name there.

I checked the users archives back to March 2023 but didn't find this issue mentioned.

Thanks,

Lotic
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20260323/70f65792/attachment.htm>