From efcc04707b83d6f5bdb11ee783a785bb6932caf4 Mon Sep 17 00:00:00 2001
From: Ruben Beltran del Rio <jj@r.bdr.sh>
Date: Mon, 29 Jun 2026 12:49:53 +0200
Subject: Fix OIDC form response

---
 src/server.js | 8 ++++++++
 1 file changed, 8 insertions(+)

(limited to 'src/server.js')

diff --git a/src/server.js b/src/server.js
index 3cb08da..f39ba21 100644
--- a/src/server.js
+++ b/src/server.js
@@ -154,6 +154,14 @@ module.exports = function createHandler(
                 clientID: oidc_clientID,
                 clientSecret: oidc_clientSecret,
                 clientAuthMethod: "client_secret_post",
+                // Use the authorization code flow with a query response so the
+                // callback arrives as a GET. The default id_token flow uses a
+                // form_post, whose body is drained by async session middleware
+                // before it can be parsed ("stream is not readable").
+                authorizationParams: {
+                    response_type: "code",
+                    response_mode: "query",
+                },
                 issuerBaseURL: oidc_issuerBaseURL,
                 secret: oidc_secret,
                 enableTelemetry: false,
-- 
cgit