OIDC compliance for flask server: POST to /authorize does not use form data about authlib HOT 4 CLOSED

@rudyardrichter I'm sorry for the misunderstanding. Currently only the OIDC client part is implemented, the server part is not yet. The next version is focusing on OAuth 1 server, so that it will take some time for OIDC server ready to use.

get_authorization_grant attempts to parse params from query string (not form data)

No, it should parse params from query string. This authorization_grant is used for the "dialog page that user (with or without login form) is asked to grant the access (or not)". This very page is landed by a redirection from your application to the OAuth server, it can't be a POST request.

from authlib.

@lepture Supporting POST to the authorization endpoint is optional according to RFC 6749:

The authorization server MUST support the use of the HTTP "GET"
method [RFC2616] for the authorization endpoint and MAY support the
use of the "POST" method as well.

and mandatory in OIDC:

Authorization Servers MUST support the use of the HTTP GET and POST
methods defined in RFC 2616 [RFC2616] at the Authorization Endpoint.
Clients MAY use the HTTP GET or POST methods to send the Authorization
Request to the Authorization Server.

where, as I quoted above, OIDC stipulates that parameters for POST be in form data.

I suppose this is slightly moot until OIDC provider is supported. Still, even for OAuth, it would be nice to allow support for use of POST for the authorization endpoint.

from authlib.

@rudyardrichter yes, you are right. I'll make a change in v0.4.

from authlib.

It's collecting form data now. close it.

from authlib.