Auto-post OIDC authorization response?

[Scott Cantor]

> As we have it deployed, the OIDC response is an HTTP 302 redirect, which Chrome blocks.

Well, no, obviously Chrome itself doesn't, so I presume what you mean is someone at your organization is imposing unnecessary "security" rules. That's a non-technical problem, I would argue.

But I am not aware of any support for code responses over POST, no. The OAuth RFC is somewhat silent about it being required to be a GET from what I can see, but it certainly isn't required to support POST and it's not something existing metadata appears to support for signaling it.

There's also [1] but that's really a replacement for "implicit", which was designed rather oddly, and I can't say I would disagree with supporting it because that's how SAML works, and there are good reasons why it's better, despite one big drawback.

So my personal take would be that we eventually support that if we don't now.

-- Scott

[1] https://openid.net/specs/oauth-v2-form-post-response-mode-1_0.html