On Sun, Sep 20, 2026 at 6:59 PM Warren Parad <wparad= [email protected]> wrote:
> Yes it's valid. No it isn't redirectable. > Isn't this a bit contradictory? The whole point of the Authorization Endpoint ( https://www.rfc-editor.org/info/rfc6749/#section-3.1) is to redirect to a Redirection Endpoint "after completing […] interaction with the resource owner". If invalid_client is not redirectable, then it cannot be used by the authorization endpoint, as defined in RFC 6749. Response types other than code or token (or rather, response modes other than fragment, query or form_post; but response_mode is not defined in RFC 6749) could possibly use other means of returning a response to the client that doesn't involve a redirect (such as the once/twice proposed response_mode=web_message) but then it would likely be those that would register be linked from the registry in addition to RFC 6749? Or are you saying that the registry listing invalid_client for the authorization endpoint was specifically done in prevision for other response modes? (i.e. to not forbid them from using that error code) > On Sun, Sep 20, 2026, 18:37 Emelia S. <emelia= > [email protected]> wrote: > >> Hi all, >> >> In the OAuth Extensions Error Registry managed by IANA, invalid_client is >> listed as having a usage location of "token endpoint, authorization >> endpoint", citing RFC6749, however, RFC6749's Section 4.1.2.1 >> "Authorization Code Grant -> Authorization Response -> Error Response" does >> not list invalid_client. >> >> https://www.iana.org/assignments/oauth-parameters#extensions-error >> >> I'm not sure where the IANA registry contents is from, given that RFC6749 >> does not include the initial registry contents. The only place >> invalid_client is listed in RFC6749 is on the token endpoint. >> >> Can someone clarify if `invalid_client` is valid for the authorization >> endpoint and if that error is redirectable? >> >> — Emelia >> _______________________________________________ >> OAuth mailing list -- [email protected] >> To unsubscribe send an email to [email protected] >> > _______________________________________________ > OAuth mailing list -- [email protected] > To unsubscribe send an email to [email protected] > -- Thomas Broyer /tɔ.ma.bʁwa.je/ <https://ipa-reader.com/?text=t%C9%94.ma.b%CA%81wa.je&voice=Mathieu>
_______________________________________________ OAuth mailing list -- [email protected] To unsubscribe send an email to [email protected]
