How to handle responses from Authlete API
Most of Authlete APIs make a response that includes "action" parameter. On implementing an authorization server with Authlete, there is a principle of processing; making a request to one of Authlete's APIs, parsing a response from the API, checking a value of "action" in the response and processing in accordance with the value.
For example, an response from /auth/authorization API includes either the following values in "action" field:
- BAD_REQUEST
- FORM
- INTERACTION
- INTERNAL_SERVER_ERROR
- LOCATION
- NO_INTERACTION
action=INTERACTION indicates that an authorization request is valid. Your authorization server is expected to generate a webpage (HTML) to authenticate a user and ask his/her consent, send the webpage to the user's Web browser, and do some interaction with him/her. Once the auth process is done successfully, your authorization server will make a request to /auth/authorization/issue API. if unsuccessful (e.g. the user cancelled the process), the server will do a request to /auth/authorization/fail API instead. (cf. Ticket Parameter in Authorization Endpoint)
action=BAD_REQUEST indicates that an authorization request is invalid and your authorization server should make a "400 Bad Request" response to Web browser. The response will be like this:
HTTP/1.1 400 Bad Request Content-Type: application/json Cache-Control: no-store Pragma: no-cache (API レスポンスに含まれる responseContent の値をここに置く)
action=LOCATION indicates that your authorization server is expected to make a "302 Found" response to Web browser. The response will be like this:
HTTP/1.1 302 Found Location: (API レスポンスに含まれる responseContent の値をここに置く) Cache-Control: no-store Pragma: no-cache
How did we do with this article?