Merge pull request authts#1248 from authts/response-mode-optional

Response mode optional

Author: pamapa

docs/migration.md

@@ -10,6 +10,7 @@ The API is largely backwards-compatible. The merge claims behavior has been impr
   - `refreshTokenCredentials` use `fetchRequestCredentials` since 2.1.0
 - the `mergeClaims` has been replaced by `mergeClaimsStrategy`
   - if the previous behavior is needed `mergeClaimsStrategy: { array: "merge" }` can be used
+- default of `response_mode` changed from `query` → `undefined`
 
 
 ## oidc-client v1.11.5 → oidc-client-ts v2.0.0

docs/oidc-client-ts.api.md

@@ -432,7 +432,7 @@ export class OidcClientSettingsStore {
     // (undocumented)
     readonly resource: string | string[] | undefined;
     // (undocumented)
-    readonly response_mode: "query" | "fragment";
+    readonly response_mode: "query" | "fragment" | undefined;
     // (undocumented)
     readonly response_type: string;
     // (undocumented)

src/OidcClientSettings.ts

@@ -9,7 +9,6 @@ import { InMemoryWebStorage } from "./InMemoryWebStorage";
 const DefaultResponseType = "code";
 const DefaultScope = "openid";
 const DefaultClientAuthentication = "client_secret_post";
-const DefaultResponseMode = "query";
 const DefaultStaleStateAgeInSeconds = 60 * 15;
 
 /**
@@ -72,7 +71,14 @@ export interface OidcClientSettings {
     /** optional protocol param */
     resource?: string | string[];
 
-    /** optional protocol param (default: "query") */
+    /**
+     * Optional protocol param
+     * The response mode used by the authority server is defined by the response_type unless explicitly specified:
+     * - Response mode for the OAuth 2.0 response type "code" is the "query" encoding
+     * - Response mode for the OAuth 2.0 response type "token" is the "fragment" encoding
+     *
+     * @see https://openid.net/specs/oauth-v2-multiple-response-types-1_0.html#ResponseModes
+     */
     response_mode?: "query" | "fragment";
 
     /**
@@ -163,7 +169,7 @@ export class OidcClientSettingsStore {
     public readonly ui_locales: string | undefined;
     public readonly acr_values: string | undefined;
     public readonly resource: string | string[] | undefined;
-    public readonly response_mode: "query" | "fragment";
+    public readonly response_mode: "query" | "fragment" | undefined;
 
     // behavior flags
     public readonly filterProtocolClaims: boolean | string[];
@@ -191,7 +197,7 @@ export class OidcClientSettingsStore {
         redirect_uri, post_logout_redirect_uri,
         client_authentication = DefaultClientAuthentication,
         // optional protocol
-        prompt, display, max_age, ui_locales, acr_values, resource, response_mode = DefaultResponseMode,
+        prompt, display, max_age, ui_locales, acr_values, resource, response_mode,
         // behavior flags
         filterProtocolClaims = true,
         loadUserInfo = false,