wso2/identity-apps

[Portals] Use form_post for Authorize requests

brionmario opened this issue · 0 comments

Is your feature request related to a problem? Please describe.
Currently, for authorize requests, the portals use the default response mode i.e query which triggers a redirect to the redirect_uri. But as per spec[1], there are security implications to encoding response values in the query string .

Describe the solution you'd like
Use form_post as the response_mode for authorize requests.

[1] https://openid.net/specs/oauth-v2-form-post-response-mode-1_0.html