Skip to content

Commit a12c1ea

Browse files
authored
Merge pull request #1031 from DuendeSoftware/v8-updates
V8 docs updates
2 parents 79a9b2c + fc5249d commit a12c1ea

2 files changed

Lines changed: 4 additions & 10 deletions

File tree

astro/src/content/docs/identityserver/tokens/fapi-2-0-specification.md

Lines changed: 2 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -192,11 +192,9 @@ You are now FAPI 2.0 compliant and ready to secure your high-value assets with D
192192

193193
## HTTP 303 Redirects :badge[v8.0]
194194

195-
FAPI 2.0 Section 5.3.2.2 requires that POST endpoints use HTTP 303 (See Other) redirects rather than HTTP 302. IdentityServer has supported this behavior via the `UseHttp303Redirects` option since v7.3.
195+
FAPI 2.0 Section 5.3.2.2 requires that POST endpoints use HTTP 303 (See Other) redirects rather than HTTP 302.
196196

197-
:::note
198-
As of v8.0, IdentityServer unconditionally uses HTTP 303 (See Other) redirects from POST endpoints, in compliance with FAPI 2.0 Section 5.3.2.2. The `UseHttp303Redirects` option has been removed — this behavior is always active.
199-
:::
197+
As of v8.0, IdentityServer unconditionally uses HTTP 303 (See Other) redirects from POST endpoints, in compliance with FAPI 2.0 Section 5.3.2.2.
200198

201199
## Conformance Report :badge[v8.0]
202200

astro/src/content/docs/identityserver/upgrades/v7_4-to-v8_0.md

Lines changed: 2 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -238,12 +238,8 @@ dependency. Use the `CancellationToken` passed directly to interface methods ins
238238

239239
### HTTP 303 Redirects Now Unconditional
240240

241-
`UserInteractionOptions.UseHttp303Redirects` has been removed. IdentityServer now always uses
242-
HTTP 303 (See Other) for redirects from POST endpoints, in compliance with
243-
[FAPI 2.0 Section 5.3.2.2](https://openid.net/specs/fapi-2_0-security-profile.html).
244-
245-
No action is needed unless you explicitly set `UseHttp303Redirects = false` in a previous version.
246-
If so, remove that setting — the redirect behavior can no longer be changed.
241+
IdentityServer now always uses HTTP 303 (See Other) for redirects from POST endpoints,
242+
in compliance with [FAPI 2.0 Section 5.3.2.2](https://openid.net/specs/fapi-2_0-security-profile.html).
247243

248244
### IClientStore.GetAllClientsAsync Now Required
249245

0 commit comments

Comments
 (0)