fix: write authorize error returns 303 for get method

[james-d-elliott]

This presumably fixes an issue where the WriteAuthorizeError function sets a 303 See Other when it should return a 302 Found instead when the method of the original HTTP request used the method verb 'GET'. See https://developer.mozilla.org/en-US/docs/Web/HTTP/Status/302 and https://developer.mozilla.org/en-US/docs/Web/HTTP/Status/303. The 303 See Other is typically only used when the client is being instructed to change the request method verb to 'GET' which is not relevant if it is already 'GET'.

RFC7231 Hypertext Transfer Protocol (HTTP/1.1): Semantics and Content, section 6.4.3 302 Found.
RFC7231 Hypertext Transfer Protocol (HTTP/1.1): Semantics and Content, section 6.4.4 303 See Other.
OAuth Security Topics, section 4.11 307 Redirect
OAuth Security Topics, section 4.1.2 Redirect URI Validation Attacks on Implicit Grant

Context: #636 (comment)

Related Issue or Design Document

Checklist

• I have read the contributing guidelines and signed the CLA.
• I have referenced an issue containing the design document if my change introduces a new feature.
• I have read the security policy.
• I confirm that this pull request does not address a security vulnerability.
  If this pull request addresses a security vulnerability,
  I confirm that I got approval (please contact [email protected]) from the maintainers to push the changes.
• I have added tests that prove my fix is effective or that my feature works.
• I have added the necessary documentation within the code base (if appropriate).

Further comments

[james-d-elliott]

For reference this is NOT ready to merge. It needs to be carefully examined against the specs; and I'm far less convinced it's "correct" after reading all of the linked specs that it is actually the correct move. For the sake of security I'm leaning towards the implementer needs to make this adjustment.

[mitar]

So https://datatracker.ietf.org/doc/html/draft-ietf-oauth-security-topics-25#name-307-redirect is pretty clear that 303 (see other) should simply always be returned:

If an HTTP redirection (and not, for example, JavaScript) is used for such a request, the authorization server SHOULD use HTTP status code 303 (See Other).

So I am not completely convinced that the option to return 302 (found) is needed, but it seems some people reported that their clients do not work with 303. So having 302 be returned for GET seems a reasonable thing for them, but we should get feedback from them if this really fixes things.

[mitar]

I think you should add a comment explaining and linking why is this necessary.