I am trying to find the best OAuth2 mechanism for our VueJS Single Page Application (SPA) hosted on our own backend. From my research, Authorization Code should be sufficient, as long as the redirect URI happens on the backend. If it happens on the front end, I would need to use PKCE.

The confusion I have is that I saw this spec about Form Post Response at https://openid.net/specs/oauth-v2-form-post-response-mode-1_0.html Auth0 also had an article about it https://auth0.com/docs/login/spa/authenticate-with-cookies Since my SPA is hosted on the same domain as our backend, this looks to be a valid option. I do not see much info about this spec online.

I do not understand the difference between Authorization Code grant type and using Form Post Response. Wouldn't both the mechanisms send the access token to my backend? It would be great if someone can shed some light on this.

1 Answer 1


I think I found some explanation here: https://auth0.com/docs/protocols/oauth2#how-response-mode-works

form_post: This response mode is defined by the OAuth 2.0 Form Post Response Mode specification. A successful response is 200 OK and the response parameters are embedded in an HTML form as hidden params. The action of the form is the redirect_uri and the onload attribute is configured to submit the form. Hence, after the HTML is loaded by the browser, a redirection to the redirect_uri is done.

For example, a response might be:

HTTP/1.1 200 OK
 <body onload="javascript:document.forms[0].submit()">
  <form method="post" action="https://my-redirect-uri.com/callback">
    <input type="hidden" name="state" value="klsdfY78FVN3sl6DWSjsdhfsd8r67832nb"/>
    <input type="hidden" name="id_token" value="eyJ...plD"/>
  • But why does not the server directly make the form POST to the callback? Why embedding it at all?
    – Mitar
    Commented Oct 22, 2020 at 8:15
  • @Mitar I know this is 2 years on, but form_post sends the values to the clients server in a more secure way than encoding it on the query string - while the normal usage for the redirect includes adding the token or code onto the URL as a fragment, this fragment is NOT sent to the clients backend server, its kept in the browser. Now, many OAuth implementations support putting the token or code into the actual query string itself, which will get through to the server, its more secure to do it via a POST body rather than a GET (POST bodies in general end up in fewer logs for example).
    – Moo
    Commented Apr 4, 2022 at 4:22
  • Yes, I noticed later that this is for frontend client, not the backend client.
    – Mitar
    Commented Apr 5, 2022 at 7:44
  • @Moo so to summarize, the main benefit of form_post against query string responses is that it uses POST and that it is generally less logged than GET requests? Is there other security implications other than logging?
    – azmeuk
    Commented Dec 5, 2023 at 12:37
  • How is this supposed to work when the frontend and backend are decoupled? The action URL would need to be a backend URL. Normally, a backend would respond to such a POST request with a simple "201 Created" or similar, which in this scenario, would be displayed in small black text in the top left corner of a white page (not a good user experience). Commented Feb 26 at 16:51

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .