Overview
ISO/IEC 26138:2024 - "Information technology - OpenID Connect - OAuth 2.0 multiple response type encoding practices" provides formal guidance for how Authorization Servers and Clients should encode and return parameters for OAuth 2.0 / OpenID Connect Authorization Requests that use space-separated (multiple-valued) response_type values. Published as a JTC 1 PAS document and prepared by the OpenID Foundation, the standard clarifies encoding rules, registers several response types with IANA, and defines a new response_mode request parameter.
Key topics and technical requirements
- Response Mode (response_mode): An optional Authorization Request parameter that specifies the mechanism used to return Authorization Response parameters (e.g., query vs fragment). The spec registers response_mode in the OAuth Parameters registry and advises not to send a response_mode value that duplicates the Response Type's default.
- Default encodings:
- code: default Response Mode is query encoding.
- token: default Response Mode is fragment encoding.
- id_token and multiple-valued combinations (e.g., id_token token, code id_token token) default to fragment encoding; the query encoding MUST NOT be used for these.
- none: default Response Mode is query encoding and should not be combined with other Response Types.
- Multiple-valued Response Types: When a response_type contains spaces it is treated as a set of values (order does not matter). The standard recommends returning all parameters using the same response mode (both success and error responses) to simplify client processing and reduce latency.
- New / registered Response Types: The document registers several values in the IANA OAuth Authorization Endpoint Response Types registry (e.g., id_token, none, code token, code id_token, id_token token, code id_token token) and specifies their expected returned parameters.
- Security considerations: The spec notes risks with query-string encoding (potential leakage) and explains why fragment encoding reduces exposure of sensitive tokens such as id_token.
Practical applications and intended users
- Identity and access management engineers implementing OAuth 2.0 and OpenID Connect flows.
- Authorization Server and Identity Provider (IdP) developers who must support multiple response types and correctly encode Authorization Responses.
- Client application developers (SPAs, mobile apps, web apps) who parse authorization responses and must handle fragment vs query encodings.
- Security architects and auditors assessing token leakage risks and ensuring correct registry usage.
Related standards
- RFC 6749 (OAuth 2.0)
- OpenID Connect specifications
- IANA OAuth Authorization Endpoint Response Types registry and IANA OAuth Parameters registry
Keywords: ISO/IEC 26138:2024, OpenID Connect, OAuth 2.0, response_type, response_mode, id_token, fragment encoding, query encoding, multiple-valued response types, IANA registry.