Return OAuth Access Token in header or POST

Question

I have an Spring OAuth2 server set up and it's working fine when the clients authenticate. The issue is that when the client is the browser the access token is show on the redirect URL on the address bar and the browser remembers it.

Is there a way for the Authentication server to send back the access token in a safer way while still redirecting.

Answer 1

The OAuth 2.0 Form Post Response Mode introduces a new transport mode for the access token response based on a form POST.

To use it, it has to be implemented in your authorization server and the query parameter response_mode with the value form_post has to be understood.

As far as I know, there is no specification related to a transport using a reponse header.