<html><head></head><body> <div dir="auto">Hi,</div><div dir="auto"><br></div><div dir="auto">Can the OIDC plugin be configured to return the last response from profile/oidc/authorize as HTML with a form that automatically posts the authorization code and state parameters to the relying party?</div><div dir="auto"><br></div><div dir="auto">This would be similar to how the IdP returns SAML assertions to the browser, with Javascript that submits the form when the document's loaded.</div><div dir="auto"><br></div><div dir="auto">As we have it deployed, the OIDC response is an HTTP 302 redirect, which Chrome blocks. We're required to have a form-action element in our content security policy and we don't want to solve this by managing and disclosing every RP's host name there.</div><div dir="auto"><br></div><div dir="auto">I checked the users archives back to March 2023 but didn't find this issue mentioned.</div><div dir="auto"><br></div><div dir="auto">Thanks,</div><div dir="auto"><br></div><div dir="auto">Lotic</div> </body></html>