{"record":{"id":"4caaabb4440e9556","repo":"anomalyco/sst","slug":"unsupported-response-type-response-type","errorCode":null,"errorMessage":"Unsupported response_type: ${response_type}","messagePattern":"Unsupported response_type: (.+?)","errorType":"http","errorClass":null,"httpStatus":400,"severity":"error","filePath":"sdk/js/src/auth/handler.ts","lineNumber":200,"sourceCode":"            if (response_type === \"code\") {\n              // This allows the code to be reused within a 30 second window\n              // The code should be single use but we're making this tradeoff to remain stateless\n              // In the future can store this in a dynamo table to ensure single use\n              const code = await new SignJWT({\n                client_id,\n                redirect_uri,\n                token,\n              })\n                .setProtectedHeader({ alg: \"RS512\" })\n                .setExpirationTime(\"30s\")\n                .sign(await options.signing.privateKey());\n              const location = new URL(redirect_uri);\n              location.searchParams.set(\"code\", code);\n              location.searchParams.set(\"state\", state || \"\");\n              return ctx.redirect(location.toString(), 302);\n            }\n\n            ctx.status(400);\n            return ctx.text(`Unsupported response_type: ${response_type}`);\n          },\n        },\n        {\n          provider: ctx.get(\"provider\"),\n          ...properties,\n        },\n        ctx.req.raw\n      );\n    },\n    forward(ctx: Context, response: Response) {\n      return ctx.newResponse(\n        response.body,\n        response.status as any,\n        Object.fromEntries((response.headers as any).entries())\n      );\n    },\n    cookie(c, key, value, maxAge) {","sourceCodeStart":182,"sourceCodeEnd":218,"githubUrl":"https://github.com/anomalyco/sst/blob/a0bd20f762883e72a35caccb4896c42ce5b3f707/sdk/js/src/auth/handler.ts#L182-L218","documentation":"SST's AuthHandler OAuth authorize endpoint only supports response_type=code. When the authorization request carries any other response_type (e.g. token, id_token), it responds with HTTP 400 and this plain-text message instead of redirecting with an authorization code.","triggerScenarios":"Hitting the auth /authorize route with query parameter response_type set to something other than \"code\" — e.g. implicit-flow clients sending response_type=token.","commonSituations":"An OAuth client configured for the implicit flow (response_type=token) pointing at SST's auth handler; hand-crafted authorize URLs with a typo (responseType=code or response_type=codes); a generic OAuth library defaulting to a non-code flow.","solutions":["Change the client to use the authorization code flow: response_type=code in the authorize URL.","Check for typos in the response_type parameter value (must be exactly `code`).","If the client library hardcodes an implicit flow, reconfigure it or use a different provider adapter.","Verify the full authorize URL: client_id, redirect_uri, and response_type are all validated before the redirect is issued."],"exampleFix":"// before\nconst url = `${authUrl}?client_id=x&redirect_uri=${cb}&response_type=token`;\n\n// after\nconst url = `${authUrl}?client_id=x&redirect_uri=${cb}&response_type=code`;\n\nexport const handler = AuthHandler({\n  providers: { /* ... */ },\n  callbacks: {\n    auth: { success: async (ctx) => ctx.redirect(\"/\"), error: async (ctx) => ctx.redirect(\"/error\") },\n  },\n});","handlingStrategy":"validation","validationCode":"// validate the authorize URL on the client before redirecting\nconst params = new URL(authorizeUrl).searchParams;\nif (params.get(\"response_type\") !== \"code\") {\n  throw new Error(`response_type must be \"code\", got ${params.get(\"response_type\")}`);\n}","typeGuard":"function usesCodeFlow(params: URLSearchParams): params is URLSearchParams & { get(k: \"response_type\"): \"code\" } {\n  return params.get(\"response_type\") === \"code\";\n}","tryCatchPattern":"// server returns 400 text, not JSON — check status\nconst res = await fetch(authorizeUrl, { redirect: \"manual\" });\nif (res.status === 400) {\n  const body = await res.text();\n  if (body.startsWith(\"Unsupported response_type\")) {\n    throw new Error(\"Fix client to use response_type=code\");\n  }\n}","preventionTips":["Configure all OAuth clients for the authorization code flow (response_type=code).","Build authorize URLs from a shared helper that hardcodes response_type=code.","Never use implicit flow (response_type=token) with SST AuthHandler.","Test the authorize URL in a browser before wiring the client library."],"tags":["oauth","auth","http-400","configuration"],"backgroundTag":"oauth-unsupported-response-type","analyzedSha":"a0bd20f762883e72a35caccb4896c42ce5b3f707","analyzedAt":"2026-08-30T11:26:00.383Z","schemaVersion":2},"datasetVersion":"2026-08-30T13:17:10.514Z"}