temporarily_
Registry Context
Use this error value when the authorization server is temporarily unable to handle an authorization request because of server overload or maintenance.
Technical Summary
`temporarily_unavailable` is an OAuth 2.0 authorization error code defined for authorization code and implicit grant error responses. The `error` parameter is a single ASCII code and cannot contain characters outside `%x20-21 / %x23-5B / %x5D-7E`.
When Used
In an authorization error response when temporary server overload or maintenance prevents the request from being handled. RFC 9700 advises clients not to use the implicit grant unless its identified leakage and injection risks are mitigated.
Normative Requirements
Clients
RFC 9700 - Section 2.1.2
use the implicit grant or another response type that issues access tokens in the authorization response..
Condition: Unless access-token injection is prevented and the identified token-leakage vectors are mitigated.
clients SHOULD NOT use the implicit grant
Authorization servers
RFC 6749 - Section 4.1.2.1
include characters outside `%x20-21 / %x23-5B / %x5D-7E` in the `error` parameter..
Condition: When returning an authorization code grant error response.
Values for the "error" parameter MUST NOT include characters outside the set
RFC 6749 - Section 4.2.2.1
include characters outside `%x20-21 / %x23-5B / %x5D-7E` in the `error` parameter..
Condition: When returning an implicit grant error response.
Values for the "error" parameter MUST NOT include characters outside the set
RFC 6749 - Section 4.1.2.1
include an `error` parameter containing a single ASCII error code..
Condition: When returning an authorization code grant error response through the client's redirection URI.
error REQUIRED. A single ASCII error code
RFC 6749 - Section 4.1.2.1
return the exact `state` value received from the client..
Condition: When the authorization code grant request included a `state` parameter and an authorization error response is returned.
REQUIRED if a "state" parameter was present
RFC 6749 - Section 4.2.2.1
include an `error` parameter containing a single ASCII error code..
Condition: When returning an implicit grant error response through the client's redirection URI.
error REQUIRED. A single ASCII error code
RFC 6749 - Section 4.2.2.1
return the exact `state` value received from the client..
Condition: When the implicit grant request included a `state` parameter and an authorization error response is returned.
REQUIRED if a "state" parameter was present
Validation Guidance
Recognize this registry entry only when the `error` value is exactly `temporarily_unavailable`.
Require the `error` parameter in authorization code and implicit grant error responses.
Reject an `error` value containing characters outside `%x20-21 / %x23-5B / %x5D-7E`.
If the authorization request contained `state`, verify that the error response contains the identical value.
Flag use of the implicit grant unless access-token injection and the identified token-leakage risks are mitigated.
Security Notes
RFC 9700 - Section 2.1.2
The implicit grant and other response types that issue access tokens in the authorization response are vulnerable to access-token leakage and replay; RFC 9700 recommends the authorization code response type instead.
Reference
Details
- Entry Id
temporarily_unavailable - Name
temporarily_unavailable - Usage Location
authorization endpoint- Protocol Extension
OAuth 2.0 Authorization Framework- Change Controller
IETF- Reference
RFC6749