From RFC 6749 section 4.2.2.1:
If the resource owner denies the access request or if the request fails for reasons other than a missing or invalid redirection URI, the authorization server informs the client by adding the following parameters to the fragment component of the redirection URI
From RFC 6749 section 4.1.2.1:
If the resource owner denies the access request or if the request fails for reasons other than a missing or invalid redirection URI, the authorization server informs the client by adding the following parameters to the query component of the redirection URI
The former applies to Implicit Grant flow requests to the Authorization Endpoint; the latter applies to Authorization Code flow requests to the Authorization Endpoint. The difference is indicated by the response_type
parameter the client sends to the Authorization Endpoint; token
indicates Implicit flow, and code
indicates Authorization Code flow. Therefore, if an error occurs, the logic is as follows:
if response_type == 'token'
error response in fragment
else if response_type == 'code'
error response in query string
else
????????????????????
end
The spec appears to leave it open what to do in the final "else". A possible client error would be to include a response_type
parameter with a value other than code
or token
. This may not meet the criteria for an un-redirectable error, so an authorization server should redirect to the redirect_uri
if possible with a suitable error response (error=invalid_request
or possibly error=unsupported_response_type
).
But where does that error parameter go? Query component or fragment? Both? Should this after all be treated as a non-redirectable error like an invalid redirect_uri
?