[Feature Request] Support OAuth/OIDC response_mode=form_post for callback responses

[maheshmoreuk]

Is your feature request related to a problem? Please describe.

Currently, Temporal Web UI only supports the standard OAuth/OIDC authorization code flow with query parameter callback responses. Supporting response_mode=form_post would align with OIDC best practices and security recommendations.

Form Post Response Mode is a security best practice that prevents sensitive authentication data (sessionid, tokens, state parameters) from appearing in URLs, server logs, and browser history. We have a self-hosted Temporal Web UI integrated with Azure Entra ID (Azure AD) for authentication, which is working correctly, but the sessionid is currently returned in the query string.

As of today, there is no environment variable or configuration option to specify the OAuth response mode (as confirmed against the Web UI environment variables and Web UI configuration documentation).

Describe the solution you'd like

Add support for configurable OAuth/OIDC response mode through:

1. New environment variable: TEMPORAL_OAUTH_RESPONSE_MODE (with default value query for backward compatibility)

   • Supported values: query, form_post

2. Alternative approach: Add a new configuration option in the Web UI server to set the response mode

Describe alternatives you've considered

• Reverse proxy/API gateway approach: Limited applicability because response_mode must be specified at the authorization request, not at the callback layer. A proxy cannot transform an existing query-parameter response into form_post retroactively.

Additional context

Current Behavior:

OAuth callback response: /auth/callback?session=abc123&state=xyz

Desired Behavior:

OAuth callback response via POST with form data:

session=abc123
state=xyz

Environment Details:

• Temporal Web UI Version: 2.50.0
• OIDC Provider: Azure Entra ID
• Deployment: Self-hosted
• Related OIDC Spec: OAuth 2.0 Form Post Response Mode

This feature would enable organizations to follow OIDC security best practices without requiring additional proxy layers or workarounds.