[Bug]: The behavior of response_mode does not adhere to the guidelines

[ay4toh5i]

[Bug]: The behavior of response_mode does not adhere to the guidelines

[muhlemmer]

@ay4toh5i I don't understand why you are opening a bug if there is already a feature request #515 which you are clearly aware of? From our point of view, if a new guideline or standard is published, the implementation of such standard is a feature or enhancement, not a bug.

We maintain a list features in the https://github.com/zitadel/oidc/blob/main/README.md#features. Only if we misbehave with regards to the mentioned standards, we consider that a bug.

We do appreciate the PR which you send, I will have a look at it shortly.

[ay4toh5i]

@muhlemmer
This issue concerns the behavior of the response_mode being not form_post.
The specification OpenID Connect Core 1.0(2014) includes the response_mode parameter and it refers to OAuth 2.0 Multiple Response Type Encoding Practices(2014)
in the description of the response_mode .
So this specification is not a new standard, but is already included OpenID Connect Core 1.0.

That document states that under no circumstances should a set of Authorization Response parameters, whose default Response Mode is the fragment encoding, be encoded using the query encoding.

As you mentioned, zitadel/oidc should have implemented OpenID Connect Core 1.0 implicit flow.
Therefore, I believe this behavior could be considered a deviation from the expected standard and may need to be addressed as such.