Table of Contents
Most of Authlete APIs make a response that includes “action” parameter. On implementing an authorization server with Authlete, there is a principle of processing; making a request to one of Authlete’s APIs, parsing a response from the API, checking a value of “action” in the response and processing in accordance with the value.
You NEVER use a value of resultCode as condition of processing.
For example, an response from /auth/authorization API includes either the following values in “action” field:
action=INTERACTION indicates that an authorization request is valid. Your authorization server is expected to generate a webpage (HTML) to authenticate a user and ask his/her consent, send the webpage to the user’s Web browser, and do some interaction with him/her. Once the auth process is done successfully, your authorization server will make a request to /auth/authorization/issue API. if unsuccessful (e.g. the user cancelled the process), the server will do a request to /auth/authorization/fail API instead. (cf. Ticket Parameter in Authorization Endpoint ）
action=BAD_REQUEST indicates that an authorization request is invalid and your authorization server should make a “400 Bad Request” response to Web browser. The response will be like this:
HTTP/1.1 400 Bad Request
Content-Type: application/json
Cache-Control: no-store
Pragma: no-cache
(API レスポンスに含まれる responseContent の値をここに置く)
action=LOCATION indicates that your authorization server is expected to make a “302 Found” response to Web browser. The response will be like this:
HTTP/1.1 302 Found
Location: (API レスポンスに含まれる responseContent の値をここに置く)
Cache-Control: no-store
Pragma: no-cache