From 908c84b7663d50b7229e5fa34f7e9d24d2ce8b1e Mon Sep 17 00:00:00 2001
From: Ashok Kumar Ramakrishnan <83938949+ashok672@users.noreply.github.com>
Date: Mon, 22 Dec 2025 18:03:57 -0800
Subject: [PATCH 1/6] Initial changes

---
 msal/oauth2cli/authcode.py  |  62 +++++++++++----
 msal/oauth2cli/oauth2.py    |  11 ++-
 tests/test_authcode.py      | 148 +++++++++++++++++++++++++++++++++++-
 tests/test_response_mode.py | 112 +++++++++++++++++++++++++++
 4 files changed, 313 insertions(+), 20 deletions(-)
 create mode 100644 tests/test_response_mode.py

diff --git a/msal/oauth2cli/authcode.py b/msal/oauth2cli/authcode.py
index ba266223..85e3f1e6 100644
--- a/msal/oauth2cli/authcode.py
+++ b/msal/oauth2cli/authcode.py
@@ -112,26 +112,56 @@ def do_GET(self):
         # For flexibility, we choose to not check self.path matching redirect_uri
         #assert self.path.startswith('/THE_PATH_REGISTERED_BY_THE_APP')
         qs = parse_qs(urlparse(self.path).query)
-        if qs.get('code') or qs.get("error"):  # So, it is an auth response
-            auth_response = _qs2kv(qs)
-            logger.debug("Got auth response: %s", auth_response)
-            if self.server.auth_state and self.server.auth_state != auth_response.get("state"):
-                # OAuth2 successful and error responses contain state when it was used
-                # https://www.rfc-editor.org/rfc/rfc6749#section-4.2.2.1
-                self._send_full_response("State mismatch")  # Possibly an attack
-            else:
-                template = (self.server.success_template
-                    if "code" in qs else self.server.error_template)
-                if _is_html(template.template):
-                    safe_data = _escape(auth_response)  # Foiling an XSS attack
-                else:
-                    safe_data = auth_response
-                self._send_full_response(template.safe_substitute(**safe_data))
-                self.server.auth_response = auth_response  # Set it now, after the response is likely sent
+        if qs.get('code') or qs.get("error"):  # Auth response via query string is not allowed
+            logger.error("Received auth response via query string (GET request). "
+                        "This is a security risk. Only form_post (POST) is supported.")
+            self._send_full_response(
+                "Authentication method not supported. "
+                "The application requires response_mode=form_post for security. "
+                "Please ensure your application registration uses form_post response mode.",
+                is_ok=False)
         else:
             self._send_full_response(self.server.welcome_page)
         # NOTE: Don't do self.server.shutdown() here. It'll halt the server.
 
+    def do_POST(self):
+        # Handle form_post response mode where auth code is sent via POST body
+        content_length = int(self.headers.get('Content-Length', 0))
+        post_data = self.rfile.read(content_length).decode('utf-8')
+        try:
+            from urllib.parse import parse_qs as parse_qs_post
+        except ImportError:
+            from urlparse import parse_qs as parse_qs_post
+        
+        qs = parse_qs_post(post_data)
+        if qs.get('code') or qs.get('error'):  # So, it is an auth response
+            auth_response = _qs2kv(qs)
+            logger.debug("Got auth response via POST: %s", auth_response)
+            self._process_auth_response(auth_response)
+        else:
+            self._send_full_response("Invalid POST request", is_ok=False)
+
+    def _process_auth_response(self, auth_response):
+        """Process the auth response from either GET or POST request."""
+        if self.server.auth_state and self.server.auth_state != auth_response.get("state"):
+            # OAuth2 successful and error responses contain state when it was used
+            # https://www.rfc-editor.org/rfc/rfc6749#section-4.2.2.1
+            self._send_full_response("State mismatch")  # Possibly an attack
+        else:
+            template = (self.server.success_template
+                if "code" in auth_response else self.server.error_template)
+            if _is_html(template.template):
+                safe_data = _escape(auth_response)  # Foiling an XSS attack
+            else:
+                safe_data = dict(auth_response)  # Make a copy to avoid mutating original
+            # Provide default values for common OAuth2 response fields
+            # to avoid showing literal placeholder text like "$error_description"
+            safe_data.setdefault("error", "")
+            safe_data.setdefault("error_description", "")
+            safe_data.setdefault("error_uri", "")
+            self._send_full_response(template.safe_substitute(**safe_data))
+            self.server.auth_response = auth_response  # Set it now, after the response is likely sent
+
     def _send_full_response(self, body, is_ok=True):
         self.send_response(200 if is_ok else 400)
         content_type = 'text/html' if _is_html(body) else 'text/plain'
diff --git a/msal/oauth2cli/oauth2.py b/msal/oauth2cli/oauth2.py
index ef32ceaa..7875c4d7 100644
--- a/msal/oauth2cli/oauth2.py
+++ b/msal/oauth2cli/oauth2.py
@@ -176,7 +176,16 @@ def _build_auth_request_params(self, response_type, **kwargs):
         response_type = self._stringify(response_type)
 
         params = {'client_id': self.client_id, 'response_type': response_type}
-        params.update(kwargs)  # Note: None values will override params
+        # Strictly enforce form_post for security - query string is not allowed
+        params['response_mode'] = 'form_post'
+        if 'response_mode' in kwargs and kwargs['response_mode'] != 'form_post':
+            import warnings
+            warnings.warn(
+                "response_mode='{}' is not supported for security reasons. "
+                "Using form_post instead. Query string transmission of authorization "
+                "codes is insecure and has been disabled.".format(kwargs['response_mode']),
+                UserWarning)
+        params.update({k: v for k, v in kwargs.items() if k != 'response_mode'})  # Exclude response_mode from kwargs
         params = {k: v for k, v in params.items() if v is not None}  # clean up
         if params.get('scope'):
             params['scope'] = self._stringify(params['scope'])
diff --git a/tests/test_authcode.py b/tests/test_authcode.py
index 329cafd8..fd38c294 100644
--- a/tests/test_authcode.py
+++ b/tests/test_authcode.py
@@ -26,17 +26,159 @@ def test_no_two_concurrent_receivers_can_listen_on_same_port(self):
                     pass
 
     def test_template_should_escape_input(self):
+        """Test that POST request with HTML in error is properly escaped"""
         with AuthCodeReceiver() as receiver:
             receiver._scheduled_actions = [(  # Injection happens here when the port is known
                 1,  # Delay it until the receiver is activated by get_auth_response()
                 lambda: self.assertEqual(
                     "<html>&lt;tag&gt;foo&lt;/tag&gt;</html>",
-                    requests.get("http://localhost:{}?error=<tag>foo</tag>".format(
-                        receiver.get_port())).text,
-                    "Unsafe data in HTML should be escaped",
+                    requests.post(
+                        "http://localhost:{}".format(receiver.get_port()),
+                        data={"error": "<tag>foo</tag>"},
+                        headers={'Content-Type': 'application/x-www-form-urlencoded'}
+                    ).text,
             ))]
             receiver.get_auth_response(  # Starts server and hang until timeout
                 timeout=3,
                 error_template="<html>$error</html>",
             )
 
+    def test_get_request_with_auth_code_is_rejected(self):
+        """Test that GET request with auth code is rejected for security"""
+        with AuthCodeReceiver() as receiver:
+            test_code = "test_auth_code_12345"
+            test_state = "test_state_67890"
+            receiver._scheduled_actions = [(
+                1,
+                lambda: self._verify_get_rejection(
+                    receiver.get_port(),
+                    code=test_code,
+                    state=test_state
+                )
+            )]
+            result = receiver.get_auth_response(
+                timeout=3,
+                state=test_state,
+            )
+            # Should not receive auth response via GET
+            self.assertIsNone(result)
+
+    def _verify_get_rejection(self, port, **params):
+        """Helper to verify GET requests with auth codes are rejected"""
+        try:
+            from urllib.parse import urlencode
+        except ImportError:
+            from urllib import urlencode
+        
+        response = requests.get(
+            "http://localhost:{}?{}".format(port, urlencode(params))
+        )
+        # Verify error message about unsupported method
+        self.assertIn("not supported", response.text.lower())
+        self.assertEqual(response.status_code, 400)
+
+    def test_post_request_with_auth_code(self):
+        """Test that POST request with auth code is handled correctly (form_post response mode)"""
+        with AuthCodeReceiver() as receiver:
+            test_code = "test_auth_code_12345"
+            test_state = "test_state_67890"
+            receiver._scheduled_actions = [(
+                1,
+                lambda: self._send_post_auth_response(
+                    receiver.get_port(),
+                    code=test_code,
+                    state=test_state
+                )
+            )]
+            result = receiver.get_auth_response(
+                timeout=3,
+                state=test_state,
+                success_template="Success: Got code $code",
+            )
+            self.assertIsNotNone(result)
+            self.assertEqual(result.get("code"), test_code)
+            self.assertEqual(result.get("state"), test_state)
+
+    def test_post_request_with_error(self):
+        """Test that POST request with error is handled correctly"""
+        with AuthCodeReceiver() as receiver:
+            test_error = "access_denied"
+            test_error_description = "User denied access"
+            receiver._scheduled_actions = [(
+                1,
+                lambda: self._send_post_auth_response(
+                    receiver.get_port(),
+                    error=test_error,
+                    error_description=test_error_description
+                )
+            )]
+            result = receiver.get_auth_response(
+                timeout=3,
+                error_template="Error: $error - $error_description",
+            )
+            self.assertIsNotNone(result)
+            self.assertEqual(result.get("error"), test_error)
+            self.assertEqual(result.get("error_description"), test_error_description)
+
+    def test_post_request_state_mismatch(self):
+        """Test that POST request with mismatched state is rejected"""
+        with AuthCodeReceiver() as receiver:
+            test_code = "test_auth_code_12345"
+            wrong_state = "wrong_state"
+            expected_state = "expected_state"
+            receiver._scheduled_actions = [(
+                1,
+                lambda: self._send_post_auth_response(
+                    receiver.get_port(),
+                    code=test_code,
+                    state=wrong_state
+                )
+            )]
+            result = receiver.get_auth_response(
+                timeout=3,
+                state=expected_state,
+            )
+            # When state mismatches, the response should not be set
+            self.assertIsNone(result)
+
+    def test_post_request_escapes_html(self):
+        """Test that POST request with HTML in error is properly escaped"""
+        with AuthCodeReceiver() as receiver:
+            malicious_error = "<script>alert('xss')</script>"
+            receiver._scheduled_actions = [(
+                1,
+                lambda: self._verify_post_escaping(receiver.get_port(), malicious_error)
+            )]
+            receiver.get_auth_response(
+                timeout=3,
+                error_template="<html>$error</html>",
+            )
+
+    def _send_post_auth_response(self, port, **params):
+        """Helper to send POST request with auth response"""
+        try:
+            from urllib.parse import urlencode
+        except ImportError:
+            from urllib import urlencode
+        
+        response = requests.post(
+            "http://localhost:{}".format(port),
+            data=params,
+            headers={'Content-Type': 'application/x-www-form-urlencoded'}
+        )
+        return response
+
+    def _verify_post_escaping(self, port, malicious_error):
+        """Helper to verify HTML escaping in POST requests"""
+        response = self._send_post_auth_response(port, error=malicious_error)
+        # Verify that the malicious script is escaped
+        self.assertIn("&lt;script&gt;", response.text)
+        self.assertNotIn("<script>", response.text)
+        # Note: The escape function also escapes single quotes to &#x27;
+        expected = "<html>&lt;script&gt;alert(&#x27;xss&#x27;)&lt;/script&gt;</html>"
+        self.assertEqual(
+            expected,
+            response.text,
+            "HTML in POST data should be escaped to prevent XSS"
+        )
+
diff --git a/tests/test_response_mode.py b/tests/test_response_mode.py
new file mode 100644
index 00000000..24b18341
--- /dev/null
+++ b/tests/test_response_mode.py
@@ -0,0 +1,112 @@
+"""Tests for form_post response mode in authorization code flow"""
+import unittest
+import warnings
+try:
+    from urllib.parse import urlparse, parse_qs
+except ImportError:
+    from urlparse import urlparse, parse_qs
+
+from msal.oauth2cli import Client
+
+
+class TestResponseMode(unittest.TestCase):
+    """Test response_mode parameter in authorization code flow"""
+    
+    def setUp(self):
+        self.client = Client(
+            {
+                "authorization_endpoint": "https://example.com/authorize",
+                "token_endpoint": "https://example.com/token"
+            },
+            "test_client_id"
+        )
+    
+    def test_default_response_mode_is_form_post(self):
+        """Test that response_mode defaults to form_post for security"""
+        flow = self.client.initiate_auth_code_flow(
+            scope=["openid", "profile"],
+            redirect_uri="http://localhost:8080"
+        )
+        
+        # Parse the auth_uri to check query parameters
+        parsed = urlparse(flow["auth_uri"])
+        params = parse_qs(parsed.query)
+        
+        # Verify response_mode is set to form_post
+        self.assertIn("response_mode", params)
+        self.assertEqual(params["response_mode"][0], "form_post")
+    
+    def test_explicit_query_mode_shows_security_warning(self):
+        """Test that attempting to use query mode raises a security warning"""
+        with warnings.catch_warnings(record=True) as w:
+            warnings.simplefilter("always")
+            flow = self.client.initiate_auth_code_flow(
+                scope=["openid", "profile"],
+                redirect_uri="http://localhost:8080",
+                response_mode="query"
+            )
+            
+            # Verify a warning was raised
+            self.assertEqual(len(w), 1)
+            self.assertTrue(issubclass(w[0].category, Warning))
+            self.assertIn("security", str(w[0].message).lower())
+        
+        # Verify form_post is still enforced despite explicit query request
+        parsed = urlparse(flow["auth_uri"])
+        params = parse_qs(parsed.query)
+        self.assertEqual(params["response_mode"][0], "form_post")
+    
+    def test_explicit_fragment_mode_shows_security_warning(self):
+        """Test that attempting to use fragment mode raises a security warning"""
+        with warnings.catch_warnings(record=True) as w:
+            warnings.simplefilter("always")
+            flow = self.client.initiate_auth_code_flow(
+                scope=["openid", "profile"],
+                redirect_uri="http://localhost:8080",
+                response_mode="fragment"
+            )
+            
+            # Verify a warning was raised
+            self.assertEqual(len(w), 1)
+            self.assertIn("fragment", str(w[0].message))
+        
+        # Verify form_post is still enforced
+        parsed = urlparse(flow["auth_uri"])
+        params = parse_qs(parsed.query)
+        self.assertEqual(params["response_mode"][0], "form_post")
+    
+    def test_build_auth_request_params_enforces_form_post(self):
+        """Test that _build_auth_request_params enforces form_post"""
+        params = self.client._build_auth_request_params(
+            response_type="code",
+            redirect_uri="http://localhost:8080",
+            scope=["openid", "profile"],
+            state="test_state"
+        )
+        
+        # Verify response_mode is form_post
+        self.assertIn("response_mode", params)
+        self.assertEqual(params["response_mode"], "form_post")
+    
+    def test_build_auth_request_params_ignores_explicit_query_mode(self):
+        """Test that _build_auth_request_params ignores explicit query mode"""
+        with warnings.catch_warnings(record=True) as w:
+            warnings.simplefilter("always")
+            params = self.client._build_auth_request_params(
+                response_type="code",
+                redirect_uri="http://localhost:8080",
+                scope=["openid", "profile"],
+                state="test_state",
+                response_mode="query"
+            )
+            
+            # Verify warning was raised
+            self.assertGreater(len(w), 0)
+        
+        # Verify form_post is enforced despite explicit request
+        self.assertIn("response_mode", params)
+        self.assertEqual(params["response_mode"], "form_post")
+
+
+if __name__ == '__main__':
+    unittest.main()

From a2ac3658fb611a217f1d9dd7b28e22e3b070cd00 Mon Sep 17 00:00:00 2001
From: Ashok Kumar Ramakrishnan <83938949+ashok672@users.noreply.github.com>
Date: Thu, 8 Jan 2026 14:53:23 -0800
Subject: [PATCH 2/6] Deprecate response_mode parameter, better messages and
 more robust test

---
 msal/application.py         |  28 ++++---
 msal/oauth2cli/authcode.py  |   6 +-
 msal/oauth2cli/oauth2.py    |  11 ++-
 tests/test_response_mode.py | 157 +++++++++++++++++++-----------------
 4 files changed, 112 insertions(+), 90 deletions(-)

diff --git a/msal/application.py b/msal/application.py
index 57e40980..1eec0a24 100644
--- a/msal/application.py
+++ b/msal/application.py
@@ -258,7 +258,7 @@ def __init__(
             client_credential=None, authority=None, validate_authority=True,
             token_cache=None,
             http_client=None,
-            verify=True, proxies=None, timeout=None,
+            verify=False, proxies=None, timeout=None,
             client_claims=None, app_name=None, app_version=None,
             client_capabilities=None,
             azure_region=None,  # Note: We choose to add this param in this base class,
@@ -920,6 +920,9 @@ def initiate_auth_code_flow(
             ):
         """Initiate an auth code flow.
 
+        .. deprecated::
+            The response_mode parameter is deprecated and will be removed in a future version.
+
         Later when the response reaches your redirect_uri,
         you can use :func:`~acquire_token_by_auth_code_flow()`
         to complete the authentication/authorization.
@@ -960,18 +963,10 @@ def initiate_auth_code_flow(
             New in version 1.15.
 
         :param str response_mode:
-            OPTIONAL. Specifies the method with which response parameters should be returned.
-            The default value is equivalent to ``query``, which is still secure enough in MSAL Python
-            (because MSAL Python does not transfer tokens via query parameter in the first place).
-            For even better security, we recommend using the value ``form_post``.
-            In "form_post" mode, response parameters
-            will be encoded as HTML form values that are transmitted via the HTTP POST method and
-            encoded in the body using the application/x-www-form-urlencoded format.
-            Valid values can be either "form_post" for HTTP POST to callback URI or
-            "query" (the default) for HTTP GET with parameters encoded in query string.
-            More information on possible values
-            `here <https://openid.net/specs/oauth-v2-multiple-response-types-1_0.html#ResponseModes>`
-            and `here <https://openid.net/specs/oauth-v2-form-post-response-mode-1_0.html#FormPostResponseMode>`
+            .. deprecated::
+                This parameter is deprecated and will be removed in a future version.
+                The response_mode is always set to ``form_post`` for security reasons,
+                regardless of the value provided. Do not use this parameter.
 
         :return:
             The auth code flow. It is a dict in this form::
@@ -991,6 +986,13 @@ def initiate_auth_code_flow(
             3. and then relay this dict and subsequent auth response to
                :func:`~acquire_token_by_auth_code_flow()`.
         """
+        if response_mode is not None:
+            import warnings
+            warnings.warn(
+                "The 'response_mode' parameter is deprecated and will be removed in a future version. "
+                "Response mode is always 'form_post' for security reasons.",
+                DeprecationWarning,
+                stacklevel=2)
         client = _ClientWithCcsRoutingInfo(
             {"authorization_endpoint": self.authority.authorization_endpoint},
             self.client_id,
diff --git a/msal/oauth2cli/authcode.py b/msal/oauth2cli/authcode.py
index 85e3f1e6..112ce0d3 100644
--- a/msal/oauth2cli/authcode.py
+++ b/msal/oauth2cli/authcode.py
@@ -347,9 +347,11 @@ def _get_auth_response(self, result, auth_uri=None, timeout=None, state=None,
                     auth_uri_callback(_uri)
 
         self._server.success_template = Template(success_template or
-            "Authentication completed. You can close this window now.")
+            "Authentication complete. You can return to the application. Please close this browser tab. "
+            "For your security: Do not share the contents of this page, the address bar, or take screenshots.")
         self._server.error_template = Template(error_template or
-            "Authentication failed. $error: $error_description. ($error_uri)")
+            "Authentication failed. $error: $error_description. ($error_uri) "
+            "For your security: Do not share the contents of this page, the address bar, or take screenshots.")
 
         self._server.timeout = timeout  # Otherwise its handle_timeout() won't work
         self._server.auth_response = {}  # Shared with _AuthCodeHandler
diff --git a/msal/oauth2cli/oauth2.py b/msal/oauth2cli/oauth2.py
index 7875c4d7..9975fb0d 100644
--- a/msal/oauth2cli/oauth2.py
+++ b/msal/oauth2cli/oauth2.py
@@ -181,9 +181,7 @@ def _build_auth_request_params(self, response_type, **kwargs):
         if 'response_mode' in kwargs and kwargs['response_mode'] != 'form_post':
             import warnings
             warnings.warn(
-                "response_mode='{}' is not supported for security reasons. "
-                "Using form_post instead. Query string transmission of authorization "
-                "codes is insecure and has been disabled.".format(kwargs['response_mode']),
+                "The 'response_mode' parameter will be overridden to 'form_post' for better security.",
                 UserWarning)
         params.update({k: v for k, v in kwargs.items() if k != 'response_mode'})  # Exclude response_mode from kwargs
         params = {k: v for k, v in params.items() if v is not None}  # clean up
@@ -476,6 +474,13 @@ def initiate_auth_code_flow(
             3. and then relay this dict and subsequent auth response to
                :func:`~obtain_token_by_auth_code_flow()`.
         """
+        if "response_mode" in kwargs:
+            import warnings
+            warnings.warn(
+                "The 'response_mode' parameter is deprecated and will be removed in a future version. "
+                "Response mode is always 'form_post' for security reasons.",
+                DeprecationWarning,
+                stacklevel=2)
         response_type = kwargs.pop("response_type", "code")  # Auth Code flow
             # Must be "code" when you are using Authorization Code Grant.
             # The "token" for Implicit Grant is not applicable thus not allowed.
diff --git a/tests/test_response_mode.py b/tests/test_response_mode.py
index 24b18341..4ac9b70c 100644
--- a/tests/test_response_mode.py
+++ b/tests/test_response_mode.py
@@ -1,4 +1,4 @@
-"""Tests for form_post response mode in authorization code flow"""
+"""Integration tests for form_post response mode in authorization code flow"""
 import unittest
 import warnings
 try:
@@ -7,10 +7,12 @@
     from urlparse import urlparse, parse_qs
 
 from msal.oauth2cli import Client
+from msal.oauth2cli.authcode import AuthCodeReceiver
+import requests
 
 
-class TestResponseMode(unittest.TestCase):
-    """Test response_mode parameter in authorization code flow"""
+class TestResponseModeIntegration(unittest.TestCase):
+    """Integration test for response_mode with end-to-end authentication flow"""
     
     def setUp(self):
         self.client = Client(
@@ -20,92 +22,103 @@ def setUp(self):
             },
             "test_client_id"
         )
-    
-    def test_default_response_mode_is_form_post(self):
-        """Test that response_mode defaults to form_post for security"""
-        flow = self.client.initiate_auth_code_flow(
-            scope=["openid", "profile"],
-            redirect_uri="http://localhost:8080"
-        )
-        
-        # Parse the auth_uri to check query parameters
-        parsed = urlparse(flow["auth_uri"])
-        params = parse_qs(parsed.query)
+
+    def _send_post_auth_response(self, port, **params):
+        """Helper to send POST auth response to the receiver"""
+        try:
+            from urllib.parse import urlencode
+        except ImportError:
+            from urllib import urlencode
         
-        # Verify response_mode is set to form_post
-        self.assertIn("response_mode", params)
-        self.assertEqual(params["response_mode"][0], "form_post")
+        response = requests.post(
+            "http://localhost:{}".format(port),
+            data=urlencode(params),
+            headers={"Content-Type": "application/x-www-form-urlencoded"}
+        )
+        return response
     
-    def test_explicit_query_mode_shows_security_warning(self):
-        """Test that attempting to use query mode raises a security warning"""
+    def test_query_mode_override_with_successful_post_authentication(self):
+        """
+        Comprehensive integration test: When response_mode='query' is set,
+        verify deprecation warning, override to form_post, and successful POST authentication.
+        """
+        # Part 1: Verify deprecation and override warnings
         with warnings.catch_warnings(record=True) as w:
             warnings.simplefilter("always")
             flow = self.client.initiate_auth_code_flow(
                 scope=["openid", "profile"],
                 redirect_uri="http://localhost:8080",
-                response_mode="query"
+                response_mode="query"  # Explicitly request query mode (should be overridden)
             )
             
-            # Verify a warning was raised
-            self.assertEqual(len(w), 1)
-            self.assertTrue(issubclass(w[0].category, Warning))
-            self.assertIn("security", str(w[0].message).lower())
-        
-        # Verify form_post is still enforced despite explicit query request
-        parsed = urlparse(flow["auth_uri"])
-        params = parse_qs(parsed.query)
-        self.assertEqual(params["response_mode"][0], "form_post")
-    
-    def test_explicit_fragment_mode_shows_security_warning(self):
-        """Test that attempting to use fragment mode raises a security warning"""
-        with warnings.catch_warnings(record=True) as w:
-            warnings.simplefilter("always")
-            flow = self.client.initiate_auth_code_flow(
-                scope=["openid", "profile"],
-                redirect_uri="http://localhost:8080",
-                response_mode="fragment"
-            )
+            # Verify deprecation warning
+            deprecation_warnings = [x for x in w if issubclass(x.category, DeprecationWarning)]
+            self.assertEqual(len(deprecation_warnings), 1, "Should have exactly one deprecation warning")
+            self.assertIn("deprecated", str(deprecation_warnings[0].message).lower())
             
-            # Verify a warning was raised
-            self.assertEqual(len(w), 1)
-            self.assertIn("fragment", str(w[0].message))
+            # Verify override warning
+            user_warnings = [x for x in w if issubclass(x.category, UserWarning)]
+            self.assertEqual(len(user_warnings), 1, "Should have exactly one override warning")
+            self.assertIn("overridden", str(user_warnings[0].message).lower())
         
-        # Verify form_post is still enforced
+        # Part 2: Verify form_post is enforced in auth_uri
         parsed = urlparse(flow["auth_uri"])
         params = parse_qs(parsed.query)
-        self.assertEqual(params["response_mode"][0], "form_post")
-    
-    def test_build_auth_request_params_enforces_form_post(self):
-        """Test that _build_auth_request_params enforces form_post"""
-        params = self.client._build_auth_request_params(
-            response_type="code",
-            redirect_uri="http://localhost:8080",
-            scope=["openid", "profile"],
-            state="test_state"
-        )
-        
-        # Verify response_mode is form_post
         self.assertIn("response_mode", params)
-        self.assertEqual(params["response_mode"], "form_post")
+        self.assertEqual(params["response_mode"][0], "form_post",
+                        "response_mode should be overridden to form_post")
+        
+        # Part 3: Verify actual POST authentication works (form_post flow)
+        with AuthCodeReceiver() as receiver:
+            test_code = "test_auth_code_xyz"
+            test_state = "test_state_abc"
+            
+            receiver._scheduled_actions = [(
+                1,
+                lambda: self._send_post_auth_response(
+                    receiver.get_port(),
+                    code=test_code,
+                    state=test_state
+                )
+            )]
+            
+            result = receiver.get_auth_response(
+                timeout=3,
+                state=test_state,
+                success_template="Success: Got code $code",
+            )
+            
+            # Verify the POST request succeeded
+            self.assertIsNotNone(result, "POST authentication should succeed")
+            self.assertEqual(result.get("code"), test_code,
+                           "Should receive auth code via POST (form_post)")
+            self.assertEqual(result.get("state"), test_state,
+                           "Should receive correct state via POST")
     
-    def test_build_auth_request_params_ignores_explicit_query_mode(self):
-        """Test that _build_auth_request_params ignores explicit query mode"""
-        with warnings.catch_warnings(record=True) as w:
-            warnings.simplefilter("always")
-            params = self.client._build_auth_request_params(
-                response_type="code",
-                redirect_uri="http://localhost:8080",
-                scope=["openid", "profile"],
-                state="test_state",
-                response_mode="query"
+    def test_query_mode_get_request_rejected(self):
+        """
+        Verify that GET requests with auth code are rejected when form_post is enforced.
+        """
+        with AuthCodeReceiver() as receiver:
+            test_code = "test_auth_code_via_get"
+            
+            # Try to send auth code via GET (query string)
+            try:
+                from urllib.parse import urlencode
+            except ImportError:
+                from urllib import urlencode
+            
+            response = requests.get(
+                "http://localhost:{}?{}".format(
+                    receiver.get_port(),
+                    urlencode({"code": test_code, "state": "test"})
+                )
             )
             
-            # Verify warning was raised
-            self.assertGreater(len(w), 0)
-        
-        # Verify form_post is enforced despite explicit request
-        self.assertIn("response_mode", params)
-        self.assertEqual(params["response_mode"], "form_post")
+            # Verify the GET request is rejected
+            self.assertEqual(response.status_code, 400, "GET with auth code should be rejected")
+            self.assertIn("not supported", response.text.lower(),
+                         "Error message should indicate method not supported")
 
 
 if __name__ == '__main__':

From 4319ebf9b4a3f2d342f5111551a943c7c560fcc1 Mon Sep 17 00:00:00 2001
From: Ashok Kumar Ramakrishnan <83938949+ashok672@users.noreply.github.com>
Date: Thu, 8 Jan 2026 16:24:37 -0800
Subject: [PATCH 3/6] Update test_response_mode.py

---
 tests/test_response_mode.py | 39 +++++++++++++++++++++++--------------
 1 file changed, 24 insertions(+), 15 deletions(-)

diff --git a/tests/test_response_mode.py b/tests/test_response_mode.py
index 4ac9b70c..fc28797b 100644
--- a/tests/test_response_mode.py
+++ b/tests/test_response_mode.py
@@ -102,23 +102,32 @@ def test_query_mode_get_request_rejected(self):
         with AuthCodeReceiver() as receiver:
             test_code = "test_auth_code_via_get"
             
-            # Try to send auth code via GET (query string)
-            try:
-                from urllib.parse import urlencode
-            except ImportError:
-                from urllib import urlencode
-            
-            response = requests.get(
-                "http://localhost:{}?{}".format(
-                    receiver.get_port(),
-                    urlencode({"code": test_code, "state": "test"})
+            # Schedule the GET request to be sent after server starts
+            def send_get_request():
+                try:
+                    from urllib.parse import urlencode
+                except ImportError:
+                    from urllib import urlencode
+                
+                response = requests.get(
+                    "http://localhost:{}?{}".format(
+                        receiver.get_port(),
+                        urlencode({"code": test_code, "state": "test"})
+                    )
                 )
-            )
+                
+                # Verify the GET request is rejected
+                self.assertEqual(response.status_code, 400, "GET with auth code should be rejected")
+                self.assertIn("not supported", response.text.lower(),
+                             "Error message should indicate method not supported")
+            
+            receiver._scheduled_actions = [(1, send_get_request)]
+            
+            # Start the server (it will timeout after rejecting the GET)
+            result = receiver.get_auth_response(timeout=3)
             
-            # Verify the GET request is rejected
-            self.assertEqual(response.status_code, 400, "GET with auth code should be rejected")
-            self.assertIn("not supported", response.text.lower(),
-                         "Error message should indicate method not supported")
+            # Result should be None because GET was rejected (no auth_response set)
+            self.assertIsNone(result, "GET request should not produce auth response")
 
 
 if __name__ == '__main__':

From 0e958af3c9b313623377df491d1693b25404a274 Mon Sep 17 00:00:00 2001
From: Ashok Kumar Ramakrishnan <83938949+ashok672@users.noreply.github.com>
Date: Thu, 8 Jan 2026 18:33:53 -0800
Subject: [PATCH 4/6] Update authcode.py

---
 msal/oauth2cli/authcode.py | 29 ++++++++++++++++++++++++-----
 1 file changed, 24 insertions(+), 5 deletions(-)

diff --git a/msal/oauth2cli/authcode.py b/msal/oauth2cli/authcode.py
index 112ce0d3..9cc986c7 100644
--- a/msal/oauth2cli/authcode.py
+++ b/msal/oauth2cli/authcode.py
@@ -111,15 +111,32 @@ class _AuthCodeHandler(BaseHTTPRequestHandler):
     def do_GET(self):
         # For flexibility, we choose to not check self.path matching redirect_uri
         #assert self.path.startswith('/THE_PATH_REGISTERED_BY_THE_APP')
-        qs = parse_qs(urlparse(self.path).query)
-        if qs.get('code') or qs.get("error"):  # Auth response via query string is not allowed
-            logger.error("Received auth response via query string (GET request). "
+        parsed_url = urlparse(self.path)
+        qs = parse_qs(parsed_url.query)
+        
+        if qs.get('code'):  # Auth code via GET is a security risk - reject it
+            logger.error("Received auth code via query string (GET request). "
                         "This is a security risk. Only form_post (POST) is supported.")
             self._send_full_response(
                 "Authentication method not supported. "
                 "The application requires response_mode=form_post for security. "
                 "Please ensure your application registration uses form_post response mode.",
                 is_ok=False)
+        elif qs.get("error"):  # Errors can come via GET - process them
+            auth_response = _qs2kv(qs)
+            self._process_auth_response(auth_response)
+        elif not qs and parsed_url.path == '/':
+            # GET request to root with no query params - this is likely from clicking OK on eSTS error
+            # Treat it as an error since success would come via POST
+            logger.warning("Received GET request to root path with no query parameters - treating as authentication error")
+            auth_response = {
+                "error": "authentication_failed", 
+                "error_description": "Please close this window and try again."
+            }
+            # Include the original state so state validation doesn't fail
+            if self.server.auth_state:
+                auth_response["state"] = self.server.auth_state
+            self._process_auth_response(auth_response)
         else:
             self._send_full_response(self.server.welcome_page)
         # NOTE: Don't do self.server.shutdown() here. It'll halt the server.
@@ -147,6 +164,8 @@ def _process_auth_response(self, auth_response):
             # OAuth2 successful and error responses contain state when it was used
             # https://www.rfc-editor.org/rfc/rfc6749#section-4.2.2.1
             self._send_full_response("State mismatch")  # Possibly an attack
+            # Still set auth_response so the server doesn't hang forever
+            self.server.auth_response = auth_response
         else:
             template = (self.server.success_template
                 if "code" in auth_response else self.server.error_template)
@@ -347,10 +366,10 @@ def _get_auth_response(self, result, auth_uri=None, timeout=None, state=None,
                     auth_uri_callback(_uri)
 
         self._server.success_template = Template(success_template or
-            "Authentication complete. You can return to the application. Please close this browser tab. "
+            "Authentication complete. You can return to the application. Please close this browser tab.\n\n"
             "For your security: Do not share the contents of this page, the address bar, or take screenshots.")
         self._server.error_template = Template(error_template or
-            "Authentication failed. $error: $error_description. ($error_uri) "
+            "Authentication failed. $error: $error_description.\n\n"
             "For your security: Do not share the contents of this page, the address bar, or take screenshots.")
 
         self._server.timeout = timeout  # Otherwise its handle_timeout() won't work

From ac2c224b0618a81709dbca52d3c6b0a88bca1e88 Mon Sep 17 00:00:00 2001
From: Ashok Kumar Ramakrishnan <83938949+ashok672@users.noreply.github.com>
Date: Thu, 8 Jan 2026 18:36:41 -0800
Subject: [PATCH 5/6] Update application.py

---
 msal/application.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/msal/application.py b/msal/application.py
index 1eec0a24..88e3e00b 100644
--- a/msal/application.py
+++ b/msal/application.py
@@ -258,7 +258,7 @@ def __init__(
             client_credential=None, authority=None, validate_authority=True,
             token_cache=None,
             http_client=None,
-            verify=False, proxies=None, timeout=None,
+            verify=True, proxies=None, timeout=None,
             client_claims=None, app_name=None, app_version=None,
             client_capabilities=None,
             azure_region=None,  # Note: We choose to add this param in this base class,

From 00a4bc0267ff9a2c1c1ed10d921da17b40496ad8 Mon Sep 17 00:00:00 2001
From: Ashok Kumar Ramakrishnan <83938949+ashok672@users.noreply.github.com>
Date: Fri, 9 Jan 2026 12:59:17 -0800
Subject: [PATCH 6/6] Fix test failure in  state_mismatch test

---
 msal/oauth2cli/authcode.py | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/msal/oauth2cli/authcode.py b/msal/oauth2cli/authcode.py
index 9cc986c7..3d960211 100644
--- a/msal/oauth2cli/authcode.py
+++ b/msal/oauth2cli/authcode.py
@@ -164,8 +164,8 @@ def _process_auth_response(self, auth_response):
             # OAuth2 successful and error responses contain state when it was used
             # https://www.rfc-editor.org/rfc/rfc6749#section-4.2.2.1
             self._send_full_response("State mismatch")  # Possibly an attack
-            # Still set auth_response so the server doesn't hang forever
-            self.server.auth_response = auth_response
+            # Don't set auth_response for security, but mark as done to avoid hanging
+            self.server.done = True
         else:
             template = (self.server.success_template
                 if "code" in auth_response else self.server.error_template)
@@ -375,12 +375,13 @@ def _get_auth_response(self, result, auth_uri=None, timeout=None, state=None,
         self._server.timeout = timeout  # Otherwise its handle_timeout() won't work
         self._server.auth_response = {}  # Shared with _AuthCodeHandler
         self._server.auth_state = state  # So handler will check it before sending response
+        self._server.done = False  # Flag to indicate completion without setting auth_response
         while not self._closing:  # Otherwise, the handle_request() attempt
                                   # would yield noisy ValueError trace
             # Derived from
             # https://docs.python.org/2/library/basehttpserver.html#more-examples
             self._server.handle_request()
-            if self._server.auth_response:
+            if self._server.auth_response or self._server.done:
                 break
         result.update(self._server.auth_response)  # Return via writable result param