Oauth Authorize Post

OIDC Core §3.1.2.1: the authorization endpoint MUST support POST with the parameters form-encoded in the body (application/x-www-form-urlencoded). Same handling as GET. Note the browser session cookie is SameSite=Lax, so a cross-site POST arrives WITHOUT it and always takes the ceremony path — a forged form cannot obtain a silent authorization.

Response Body