Overview
ISO/IEC 26139:2024 specifies the OpenID Connect - OAuth 2.0 Form Post Response Mode (response_mode = "form_post"). The standard defines how an Authorization Response is encoded as HTML form values that are auto-submitted by the User Agent and transmitted to the Client via the HTTP POST method. Result parameters are placed in the request body using the application/x-www-form-urlencoded format. The document standardizes the form_post response mode behavior, usage constraints, and security guidance for implementers.
Key topics and requirements
- Definition of the form_post response mode: Authorization Response parameters are encoded as HTML form values auto-submitted in the User Agent and POSTed to the Client.
- Mandatory form attributes:
- The form action attribute MUST be the Client’s Redirection URI.
- The form method attribute MUST be POST.
- Single-use response handling: the Authorization Server MUST instruct the User Agent and intermediaries not to store or reuse response content.
- Client processing requirements: any UA-supported technique may be used to submit the form (auto-submit, scripting, submit controls), but the Client MUST be able to process the message regardless of how submission was initiated.
- Encoding and media type: response parameters are encoded in the body with application/x-www-form-urlencoded.
- Administrative notes: the specification makes no IANA requests and cites normative references such as OAuth 2.0 and relevant RFCs.
Applications and practical value
- Secure transmission of OpenID Connect / OAuth 2.0 Authorization Response parameters from Authorization Server to Client.
- Alternative to query-string or fragment encodings when minimizing exposure in browser history, logs, or intermediaries is a concern. The standard explicitly notes that form_post can address some security implications of query or fragment encodings.
- Implementation scenarios include identity providers (authorization servers), relying party (Client) web applications, and libraries handling OpenID Connect/OAuth 2.0 flows where a POST-based redirect is preferred.
- The Appendix provides a non-normative auto-submitted HTML form example showing hidden inputs for parameters (e.g., id_token, state) and resulting application/x-www-form-urlencoded POST to the Client.
Who should use this standard
- OAuth 2.0 / OpenID Connect implementers (Authorization Server and Client developers)
- Identity and access management architects and engineers
- Web application and security engineers seeking standardized response modes for token delivery
Related standards
- OAuth 2.0 Authorization Framework (RFC 6749)
- OAuth 2.0 Multiple Response Type Encoding Practices
- HTTP/1.1 message syntax and routing (RFC 7230)
- RFC 2119 requirement keywords
Keywords: ISO/IEC 26139:2024, OpenID Connect, OAuth 2.0, form_post, response mode, application/x-www-form-urlencoded, HTTP POST, User Agent, Authorization Response.