diff --git a/input/pagecontent/changelog.md b/input/pagecontent/changelog.md index 4a51bcd..6bf593c 100644 --- a/input/pagecontent/changelog.md +++ b/input/pagecontent/changelog.md @@ -11,6 +11,7 @@ In addition to the tickets below, this version includes changes necessary to mov |[FHIR-57840](https://jira.hl7.org/browse/FHIR-57840)|Clarify that a person may be assigned more than one (iss,sub) pair| |[FHIR-57844](https://jira.hl7.org/browse/FHIR-57844)|Clarify that registration modifications are validated in same manner as new requests| |[FHIR-57937](https://jira.hl7.org/browse/FHIR-57937)|Clarify that complete redirection URIs are required for registraton| +|[FHIR-52960](https://jira.hl7.org/browse/FHIR-52960)|Require servers to support POST| |[FHIR-58057](https://jira.hl7.org/browse/FHIR-58057)|Clarify Resource Server must process access tokens as per RFC 6749| ### Version 2.0.0 diff --git a/input/pagecontent/general.md b/input/pagecontent/general.md index bcdb1f0..bbd5019 100644 --- a/input/pagecontent/general.md +++ b/input/pagecontent/general.md @@ -156,6 +156,8 @@ A Client application **SHALL** include the `state` parameter in its authorizatio Servers **SHALL** include the `state` parameter and corresponding value provided by the client application in the authorization response as per RFC 6749. The client application **SHALL NOT** proceed if the `state` parameter is not included in the authorization response or its value does not match the value provided by the client application in the corresponding authorization request. +Authorization Servers **SHALL** support both `GET` and `POST` requests to their authorization endpoint for the authorization code flow. Clients **SHALL** support at least one of these two HTTP methods. + #### Proof Key for Code Exchange (PKCE) Client applications and Authorization Servers **SHALL** utilize Proof Key for Code Exchange (PKCE) with `code_challenge_method` of `S256` as defined in RFC 7636. An Authorization Server **SHOULD** return an error as per Section 4.4.1 of RFC 7636 if a client application does not include a `code_challenge` is its authorization request.