unsupported_
Registry Context
Error code indicating that an authorization server does not support obtaining the requested authorization result using the requested response type.
Technical Summary
RFC 6749 defines this authorization-endpoint error for authorization code and implicit grant error responses. A missing or unrecognized response_type requires an error response, but RFC 6749 does not require that unsupported_response_type be used specifically for a missing response_type.
When Used
In an authorization response when the requested method cannot produce an authorization code or access token. RFC 9700 advises clients against response types that issue access tokens in the authorization response unless specified mitigations are in place.
Normative Requirements
Clients
RFC 9700 - Section 2.1.2
use the implicit grant or another response type that issues access tokens in the authorization response.
Condition: Unless access-token injection is prevented and the identified token-leakage vectors are mitigated.
Clients SHOULD NOT use the implicit grant (response type token) or other response types issuing access tokens in the authorization response, unless access token injection in the authorization response is prevented and the aforementioned token leakage vectors are mitigated.
RFC 9700 - Section 2.1.2
use response type code or another response type that causes access tokens to be issued in the token response.
Condition: Instead of using the implicit grant or another response type that issues access tokens in the authorization response.
Clients SHOULD instead use the response type code or any other response type that causes the authorization server to issue access tokens in the token response.
Authorization servers
RFC 6749 - Section 4.1.2.1
include characters outside %x20-21 / %x23-5B / %x5D-7E in the error parameter.
Condition: When returning an authorization code grant error response.
Values for the "error" parameter MUST NOT include characters outside the set %x20-21 / %x23-5B / %x5D-7E.
RFC 6749 - Section 4.2.2.1
include characters outside %x20-21 / %x23-5B / %x5D-7E in the error parameter.
Condition: When returning an implicit grant error response.
Values for the "error" parameter MUST NOT include characters outside the set %x20-21 / %x23-5B / %x5D-7E.
RFC 6749 - Section 3.1.1
return an error response as described in Section 4.1.2.1.
Condition: When an authorization request is missing the response_type parameter or the response type is not understood.
If an authorization request is missing the "response_type" parameter, or if the response type is not understood, the authorization server MUST return an error response.
RFC 6749 - Section 4.1.2.1
include a single ASCII error code in the error parameter.
Condition: When returning an authorization code grant error through a valid redirection URI.
error REQUIRED. A single ASCII error code from the following.
RFC 6749 - Section 4.1.2.1
include the exact state value received from the client.
Condition: When the authorization code grant request included a state parameter and an error response is returned through redirection.
state REQUIRED if a "state" parameter was present in the client authorization request.
RFC 6749 - Section 4.2.2.1
include a single ASCII error code in the error parameter.
Condition: When returning an implicit grant error through a valid redirection URI.
error REQUIRED. A single ASCII error code from the following.
RFC 6749 - Section 4.2.2.1
include the exact state value received from the client.
Condition: When the implicit grant request included a state parameter and an error response is returned through redirection.
state REQUIRED if a "state" parameter was present in the client authorization request.
error code
RFC 6749 - Section 8.5
conform to the error ABNF.
Condition: When defining an OAuth extension error code.
Error codes MUST conform to the error ABNF.
Validation Guidance
Emit an authorization error response when response_type is missing or unrecognized; do not assume RFC 6749 mandates unsupported_response_type specifically for a missing value.
Recognize unsupported_response_type as an authorization-endpoint error whose RFC 6749 meaning depends on whether the response sought an authorization code or an access token.
Require the error parameter and validate its permitted ASCII character set in authorization code and implicit grant error responses.
If the authorization request included state, require the error response to return the exact received value.
Validate extension error-code definitions against the OAuth error ABNF.
Flag use of the implicit grant or other response types issuing access tokens in the authorization response unless the RFC 9700 mitigations are satisfied.
Security Notes
RFC 9700 - Section 2.1.2
RFC 9700 identifies access-token leakage, replay, and injection risks for the implicit grant and other response types that issue access tokens in the authorization response.
Reference
Details
- Entry Id
unsupported_response_ type - Name
unsupported_response_ type - Usage Location
authorization endpoint- Protocol Extension
OAuth 2.0 Authorization Framework- Change Controller
IETF- Reference
RFC6749