`Endpoints\Authorization::handle_request()` calls `wp_die()` on every `WP_Error` returned from `handle_authorisation()` — there's a `// TODO: Handle it.` marking the spot. RFC 6749 §4.1.2.1 says most of these should redirect to the client with an error instead, since `wp_die()`'s HTML page is useless to a native or mobile client.
PKCE errors (#1) already do this via a new `get_error_redirect_url()` helper on `Types\Base` (query string for the authorization_code grant, fragment for implicit), scoped narrowly to keep that PR reviewable. This issue is migrating the rest: invalid nonce, invalid submit, unsupported `response_type`, and so on, following the same rule — an error before the redirect URI is validated dies, one after it redirects.
`Endpoints\Authorization::handle_request()` calls `wp_die()` on every `WP_Error` returned from `handle_authorisation()` — there's a `// TODO: Handle it.` marking the spot. RFC 6749 §4.1.2.1 says most of these should redirect to the client with an error instead, since `wp_die()`'s HTML page is useless to a native or mobile client.
PKCE errors (#1) already do this via a new `get_error_redirect_url()` helper on `Types\Base` (query string for the authorization_code grant, fragment for implicit), scoped narrowly to keep that PR reviewable. This issue is migrating the rest: invalid nonce, invalid submit, unsupported `response_type`, and so on, following the same rule — an error before the redirect URI is validated dies, one after it redirects.