git.iko.soy/typeable/oauth2-proxy
on master help sign in
feat: use non-default authorization request response mode in OIDC providers (#3055)

* fix: OIDC sets response mode * Update CHANGELOG

commitb905f2cd934315100dadc5c64203533fa4c9aa70 authorMichael Cornel <michael@stieler.it> dateWed 23 Jul 2025, 22:40 (1 year ago) parentdc8b162
3 files changed+35
compare with master
unifiedsplit
CHANGELOG.md+1 providers/oidc.go+5 providers/oidc_test.go+29
CHANGELOG.md+1
@@ -14,6 +14,7 @@
1414- [#2359](https://github.com/oauth2-proxy/oauth2-proxy/pull/2359) feat: add SourceHut (sr.ht) provider(@bitfehler)
1515- [#2524](https://github.com/oauth2-proxy/oauth2-proxy/pull/2524) fix: regex substitution for $ signs in upstream path handling before running envsubst (@dashkan / @tuunit)
1616- [#3104](https://github.com/oauth2-proxy/oauth2-proxy/pull/3104) feat(cookie): add feature support for cookie-secret-file (@sandy2008)
17+- [#3055](https://github.com/oauth2-proxy/oauth2-proxy/pull/3055) feat: support non-default authorization request response mode also for OIDC providers (@stieler-it)
1718
1819# V7.10.0
1920
providers/oidc.go+5
@@ -61,6 +61,11 @@ func (p *OIDCProvider) GetLoginURL(redirectURI, state, nonce string, extraParams
6161 if !p.SkipNonce {
6262 extraParams.Add("nonce", nonce)
6363 }
64+ // Response mode should only be set if a non default mode is requested
65+ if p.AuthRequestResponseMode != "" {
66+ extraParams.Add("response_mode", p.AuthRequestResponseMode)
67+ }
68+
6469 loginURL := makeLoginURL(p.Data(), redirectURI, state, extraParams)
6570 return loginURL.String()
6671}
providers/oidc_test.go+29
@@ -275,3 +275,32 @@ func TestOIDCProviderCreateSessionFromToken(t *testing.T) {
275275 })
276276 }
277277}
278+
279+func TestOIDCProviderResponseModeConfigured(t *testing.T) {
280+ providerData := &ProviderData{
281+ LoginURL: &url.URL{
282+ Scheme: "http",
283+ Host: "my.test.idp",
284+ Path: "/oauth/authorize",
285+ },
286+ AuthRequestResponseMode: "form_post",
287+ }
288+ p := NewOIDCProvider(providerData, options.OIDCOptions{})
289+
290+ result := p.GetLoginURL("https://my.test.app/oauth", "", "", url.Values{})
291+ assert.Contains(t, result, "response_mode=form_post")
292+}
293+
294+func TestOIDCProviderResponseModeNotConfigured(t *testing.T) {
295+ providerData := &ProviderData{
296+ LoginURL: &url.URL{
297+ Scheme: "http",
298+ Host: "my.test.idp",
299+ Path: "/oauth/authorize",
300+ },
301+ }
302+ p := NewOIDCProvider(providerData, options.OIDCOptions{})
303+
304+ result := p.GetLoginURL("https://my.test.app/oauth", "", "", url.Values{})
305+ assert.NotContains(t, result, "response_mode")
306+}