# Configure OKTA to make a POST request instead of GET request while doing a sign\_in on enduser dashboard **URL:** \ **Category:** OAuth/OIDC\ **Created:** [July 12, 2022, 2:16pm UTC](https://devforum.okta.com/t/configure-okta-to-make-a-post-request-instead-of-get-request-while-doing-a-sign-in-on-enduser-dashboard/21225 "2022-07-12T14:16:18Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![edimo.silva](https://avatars.discourse-cdn.com/v4/letter/e/67e7ee/32.png) [@edimo.silva](https://devforum.okta.com/u/edimo.silva)\ **Post date:** [July 12, 2022, 2:16pm UTC](https://devforum.okta.com/t/configure-okta-to-make-a-post-request-instead-of-get-request-while-doing-a-sign-in-on-enduser-dashboard/21225/1 "2022-07-12T14:16:18Z")
When end user visits [Sign In](https://dev-somenumber.okta.com/app/UserHome?fromAdmin=true) and click on the app icon a GET request is made to [http://localhost:3000/users/auth/okta/callback?code=something](http://localhost:3000/users/auth/okta/callback?code=something). Currently I receive this message ![Screen Shot 2022-07-12 at 12.03.02](https://global.discourse-cdn.com/oktadev/original/2X/8/8d3d810e557c6a218fcde4d12fb28c8371bbc48d.png) I would like to make this request to be a POST instead of a GET, what should I do? Thanks ---
**Author:** ![andrea](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/andrea/32/2172_2.png) [@andrea](https://devforum.okta.com/u/andrea)\ **Post date:** [July 12, 2022, 3:06pm UTC](https://devforum.okta.com/t/configure-okta-to-make-a-post-request-instead-of-get-request-while-doing-a-sign-in-on-enduser-dashboard/21225/2 "2022-07-12T15:06:17Z")
[This guide from Omniauth](https://github.com/omniauth/omniauth/wiki/Resolving-CVE-2015-9284) provides a recommendation. Based on this, it sounds like the POST limitation is specifically related to /auth/:provider: > If the use of GET requests to /auth/:provider is essential for your application (for example, if you are ever redirecting to /auth/:provider as part of an authentication process), then you will need to put together a more involved solution for your specific needs. This may mean redirecting to a standard log-in screen which includes link\_to ‘Log in’, ‘/auth/:provider’, method: :post or another POST/form-based approach (like button\_to). How I read this is that you can make another route in the application to redirect the user back to (from the Okta dashboard via OIDC Compliant IdP-initiated login flow) and _that_ route can then post to /auth/:provider to start the login flow app-side. You might want to read up more about the ways others have resolved this CVE in Omniauth, as this doesn’t look to be an Okta-specific issue ---
**Author:** ![edimo.silva](https://avatars.discourse-cdn.com/v4/letter/e/67e7ee/32.png) [@edimo.silva](https://devforum.okta.com/u/edimo.silva)\ **Post date:** [July 12, 2022, 3:14pm UTC](https://devforum.okta.com/t/configure-okta-to-make-a-post-request-instead-of-get-request-while-doing-a-sign-in-on-enduser-dashboard/21225/3 "2022-07-12T15:14:53Z")
Hi @andrea , thanks for answering. Let’s check if I understood. Are you suggesting to instead of having a `Sign-in redirect URI` as my “real callback endpoint” that really sign\_in the user, I should set a `Sign-in redirect URI` to a “proxy callback endpoint” that does the post request to my “real callback endpoint”? I thought OKTA would have a way of just doing a POST request instead of a GET request to my `Sign-in redirect URIs`, OKTA does not support that? Does this mean that every OKTA customer has to develop it own approach for this? I’ve read the posts about the ways others have resolved this CVE in Omniauth. The fix is to do POST instead of GET requests for sigin buttons/links they have in the application. But in this case, as I am sigining in through a button from OKTAs dashboard I cannot set it to be a POST instead of a GET. So in my understanding it is a OKTA-specific issue. ---
**Author:** ![andrea](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/andrea/32/2172_2.png) [@andrea](https://devforum.okta.com/u/andrea)\ **Post date:** [July 12, 2022, 9:19pm UTC](https://devforum.okta.com/t/configure-okta-to-make-a-post-request-instead-of-get-request-while-doing-a-sign-in-on-enduser-dashboard/21225/4 "2022-07-12T21:19:20Z")
I was suggesting updating the “Initiate Login URI” on the Okta side. That’s the one that Okta is redirecting the user to when they launch the app from their dashboard via the app tile. You’ll want to set this to a URI in your application that is _not_ `/auth/:provider`, and have your application make the POST to `/auth/:provider` instead of having to find a compatible way to get Okta to do the POST instead. ---
**Author:** ![edimo.silva](https://avatars.discourse-cdn.com/v4/letter/e/67e7ee/32.png) [@edimo.silva](https://devforum.okta.com/u/edimo.silva)\ **Post date:** [July 13, 2022, 12:46pm UTC](https://devforum.okta.com/t/configure-okta-to-make-a-post-request-instead-of-get-request-while-doing-a-sign-in-on-enduser-dashboard/21225/5 "2022-07-13T12:46:53Z")
Hi @andrea thanks for the clarification, it is clear to me now! ---
**Author:** ![system](https://global.discourse-cdn.com/oktadev/original/1X/589c4c5f80de422d01f47cee7185a7fb8227835c.png) [@system](https://devforum.okta.com/u/system)\ **Post date:** [July 14, 2022, 12:47pm UTC](https://devforum.okta.com/t/configure-okta-to-make-a-post-request-instead-of-get-request-while-doing-a-sign-in-on-enduser-dashboard/21225/6 "2022-07-14T12:47:46Z")
This topic was automatically closed 24 hours after the last reply. New replies are no longer allowed.