Auth0.js: How to get the authentication response in querystring instead of hash

[JohnCoding94]

The need is simple, hash aren't transmitted to the server, so universal apps cannot decode the token on the callback unless the params are in querystrings when invoking the redirectUri.

I looked at the parseHash method's source code and it looks like it has been planned to work with both configurations, but i don't see where i can tune this option.

[luisrudge]

Try the different responseMode configurations available in the readme: https://github.com/auth0/auth0.js#auth0webauth

[JohnCoding94]

@luisrudge thanks for the link! I didn't see this page.

I just tried, but i am redirected to https://login.eu.auth0.com/login/callback?state=***# instead of my own redirect uri after i sign in on the Auth0 hosted page (as a user), which is an error page (Oops!, something went wrong).

The error i get on this page is unsupported_response_mode: Unsupported response mode: query.

The only thing i changed is adding the responseMode: query, so it looks like this:

````js
const client = new auth0.WebAuth({
domain: conf.auth0.domain,
clientID: conf.auth0.clientId,
redirectUri: conf.auth0.redirectUri,
audience: 'https://*.eu.auth0.com/userinfo',
responseType: 'token id_token',
responseMode: 'query', // the redirect works fine if i don't override this param
scope: 'openid email'
});

client.authorize();
````

Any idea about why it is not supported?

[Eomm]

I have the same issue. I would like to have the response via queryString. Any help will be appreciated

[luisrudge]

Why do you need the response via query string?

[davidthor]

+1 on this. I have the same issue trying to build an isomorphic application using Nuxt, and ran into the same issue described by @JohnCoding94. responseMode of query seemed like the natural answer documented above, but seems to be causing problems.

[luisrudge]

I just confirmed with the backend team and that's responseMode=query is only supported for the code grant flow (responseType=code). I'm updating docs and readme to reflect that:
https://github.com/auth0/auth0.js/pull/527
https://github.com/auth0/docs/pull/5187

If you want to read more about the different flows, you can read this article which is very helpful: https://auth0.com/docs/api-auth/which-oauth-flow-to-use

[bkniffler]

Is there a reason for this? Why would you need to force the hashmode if you could also just return the info as query?

[Errorname]

Hey!
I would also like to know if there is a reason for not allowing a query responseMode. Do you have any info @luisrudge ?

[luisrudge]

yeah. According to the spec, you shouldn't return a token or id_token in the query string to prevent leaks during transport and risks to the privacy of the user.

[Errorname]

Thank you for the explanation