Deliver one sign-in by query, fragment and form post

Setup

All six response types and all three modes are real once the tenant's Flow policy and the client allow them.

1. Press Start. In Lab Photos, open OAuth > Flow policy and note the current values. Allow the implicit grant, the response types code, id_token, id_token token, code id_token, code token and code id_token token, and the modes query, fragment and form_post.

2. Open OAuth > Clients > lab-collage and allow the same grant, types and modes. Changing what a client may do revokes its existing tokens and remembered consent; that is expected.

Restore: these legacy types stay on only for this lab and the next one, which removes them. If you stop after this lab, restore the values you noted.

3. source ~/btl-oidc.sh and run btl-lab callback before each request. The listener prints what reaches it, including the fields of a form post.

Walkthrough

1. Metadata follows the policy.

GET $ISSUER/.well-known/openid-configuration

response_types_supported lists all six types and response_modes_supported all three modes.

Why it matters: a relying party reads what the provider does today, and the tenant lists a type only when its grants and a suitable mode are allowed.

2. Query, the default for code:

signin

The listener prints code, state and iss from the query string.

Why it matters: the server reads the response directly, and a short-lived, single-use, PKCE-bound code tolerates the URL's exposure.

3. Fragment:

signin response_mode=fragment

The listener receives a request for /callback with no parameters at all. The address bar shows #code=...&state=...&iss=....

Why it matters: browsers never send the fragment to the server, so only a script on the callback page could read it.

4. Form post:

signin response_mode=form_post

The tenant answers 200 with a page that submits itself; check its Cache-Control in the developer tools. The listener prints a POST with code, state and iss in the body, and the address bar and history show no code.

Why it matters: the response travels in a request body, out of URLs, logs and Referer headers.

5. Default modes and word order:

RT="code id_token" signin
RT="id_token code" signin

With no response_mode, both land in the fragment, with a code and an ID token.

Why it matters: token-bearing types default to the fragment, and response type words are a set, compared without regard to order.

6. Note what form post means for your own cookies. If your relying party kept its pending attempt in a cookie, that cookie would need SameSite=None; Secure, because the POST starts on the tenant's site, and the callback would be exempt from your framework's anti-forgery token because state, the nonce and PKCE already bind it.

Why it matters: a Lax attempt cookie does not travel with a cross-site POST, which is one of the most common causes of "no pending sign-in" after switching to form post.

Break it

1. Tokens in a URL query:

RT="id_token token" signin response_mode=query

error=invalid_request, with a description saying responses that carry tokens cannot use the query mode.

2. A mode the client lacks. Remove fragment from lab-collage and repeat walkthrough step 3: error=invalid_request, with a description naming the client. Remove it from Flow policy too, and the description names the tenant instead.

Restore: add fragment back to both, or leave it off if you will not need it in the next lab.

3. A token-bearing type without a nonce:

URL=$(RT="code id_token" signin); echo "${URL/&nonce=$NONCE/}"

Open the printed URL: error=invalid_request, saying a nonce is required when the response includes an ID token.

Check your work

Press Check my progress. The checks look for the Flow policy and client changes, a code delivered to your callback, a hybrid response with a code and an ID token, and the refusals of query-mode tokens and a missing nonce.

In Audit, each successful request shows code_issued for a code alone and tokens_issued when the authorization endpoint also returned a token.

Cleanup

Keep the types and modes for Verify at_hash and c_hash, then migrate to code, which restores them. If you stop here, restore Flow policy and lab-collage to the values you noted.