Uses query instead of fragment when handling unsupported response type

authorize_error.go

@@ -25,6 +25,8 @@ import (
 	"encoding/json"
 	"net/http"
 	"net/url"
+
+	"github.com/pkg/errors"
 )
 
 func (c *Fosite) WriteAuthorizeError(rw http.ResponseWriter, ar AuthorizeRequester, err error) {
@@ -59,7 +61,7 @@ func (c *Fosite) WriteAuthorizeError(rw http.ResponseWriter, ar AuthorizeRequest
 		query.Add("error_hint", rfcerr.Hint)
 	}
 
-	if !ar.GetResponseTypes().Exact("code") {
+	if !ar.GetResponseTypes().Exact("code") && errors.Cause(err) != ErrUnsupportedResponseType {
 		redirectURI.Fragment = query.Encode()
 	} else {
 		for key, values := range redirectURI.Query() {

authorize_error_test.go

@@ -127,6 +127,22 @@ func TestWriteAuthorizeError(t *testing.T) {
 				assert.Equal(t, a, b)
 			},
 		},
+		{
+			err: ErrUnsupportedGrantType,
+			mock: func(rw *MockResponseWriter, req *MockAuthorizeRequester) {
+				req.EXPECT().IsRedirectURIValid().Return(true)
+				req.EXPECT().GetRedirectURI().Return(copyUrl(purls[1]))
+				req.EXPECT().GetState().Return("foostate")
+				req.EXPECT().GetResponseTypes().MaxTimes(2).Return(Arguments([]string{"foobar"}))
+				rw.EXPECT().Header().Return(header)
+				rw.EXPECT().WriteHeader(http.StatusFound)
+			},
+			checkHeader: func(t *testing.T, k int) {
+				a, _ := url.Parse("https://foobar.com/?foo=bar#error=unsupported_grant_type&error_description=The+authorization+grant+type+is+not+supported+by+the+authorization+server&state=foostate")
+				b, _ := url.Parse(header.Get("Location"))
+				assert.Equal(t, a, b)
+			},
+		},
 		{
 			err: ErrInvalidRequest,
 			mock: func(rw *MockResponseWriter, req *MockAuthorizeRequester) {