From aa9439454b75bf99cfc563b9abfdd54043f62e56 Mon Sep 17 00:00:00 2001 From: Tulir Asokan Date: Sun, 2 Aug 2026 20:07:58 +0300 Subject: [PATCH] Fix conflicting information on requirement of fragment response mode --- changelogs/client_server/newsfragments/2430.clarification | 1 + content/client-server-api/_index.md | 6 +++--- 2 files changed, 4 insertions(+), 3 deletions(-) create mode 100644 changelogs/client_server/newsfragments/2430.clarification diff --git a/changelogs/client_server/newsfragments/2430.clarification b/changelogs/client_server/newsfragments/2430.clarification new file mode 100644 index 00000000..f5ebfcd1 --- /dev/null +++ b/changelogs/client_server/newsfragments/2430.clarification @@ -0,0 +1 @@ +Fixed conflicting information on whether clients using the authorisation code grant are required to use the `fragment` response mode. diff --git a/content/client-server-api/_index.md b/content/client-server-api/_index.md index ca846dec..8e8c3a2d 100644 --- a/content/client-server-api/_index.md +++ b/content/client-server-api/_index.md @@ -2409,9 +2409,9 @@ To use this grant, homeservers and clients MUST: - Support the [refresh token grant](#refresh-token-grant). - Support PKCE using the `S256` code challenge method as per [RFC 7636](https://datatracker.ietf.org/doc/html/rfc7636). - Use [pre-registered](#client-registration), strict redirect URIs. -- Use the `fragment` response mode as per [OAuth 2.0 Multiple Response Type - Encoding Practices](https://openid.net/specs/oauth-v2-multiple-response-types-1_0.html) - for clients with an HTTPS redirect URI. + +Clients with an HTTPS redirect URI SHOULD use the `fragment` response mode as per +[OAuth 2.0 Multiple Response Type Encoding Practices](https://openid.net/specs/oauth-v2-multiple-response-types-1_0.html). ##### Device authorisation grant