Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

Content-type for token request in OAuth2

Getting curious about https://www.rfc-editor.org/rfc/rfc6749#section-4.1.1

Take a look:

The client constructs the request URI by adding the following
parameters to the query component of the authorization endpoint URI
using the "application/x-www-form-urlencoded" format

...and the server has to respond with "application/json".

The questions are:

  1. Why should we use explicitly "application/x-www-form-urlencoded"?
  2. Are there any obvious benefits from urlencoded?
  3. What stops me from accepting both urlencoded and json here? Seems, that I am not really violating RFC this way.
like image 905
I S Avatar asked Dec 06 '16 14:12

I S


1 Answers

I faced with this question too. I don't know if there are any benefits from urlencoded but big player in this industry auth0.com is using application/json content type for both request and response.

enter image description here

like image 194
wildsurfer Avatar answered Sep 19 '22 21:09

wildsurfer