43 tests
Client tests
These tests check an IndieAuth client. This site acts as the server, with a profile URL for each test that behaves in one specific way.
Test your client
Client runs belong to a signed-in tester. Sign in with your website first; you don't need to test a server.
Required a MUST in the spec; not doing it fails the test.
Recommended a SHOULD or security best practice; not doing it is a warning.
Optional or Informational never fail.
Discovery
| C101 | Discovers the server from an HTML link | Required | Sign in with your client |
| C102 | Discovers the server from a Link header | Required | Sign in with your client |
| C103 | Prefers the Link header over HTML | Required | Sign in with your client |
| C104 | Uses the first HTML link | Required | Sign in with your client |
| C105 | Resolves a relative metadata URL | Required | Sign in with your client |
| C106 | Follows redirects during discovery | Required | Sign in with your client |
| C107 | Handles multiple rel values | Required | Sign in with your client |
| C108 | Supports legacy endpoint discovery | Recommended | Sign in with your client |
| C109 | Prefers metadata over legacy links | Recommended | Sign in with your client |
| C110 | Uses endpoints on another host | Required | Sign in with your client |
| C111 | Accepts a URL typed without a scheme | Optional | Sign in with your client |
Authorization requests
| C201 | Requests an authorization code | Required | Automatic |
| C202 | Sends a valid client_id | Required | Automatic |
| C203 | Uses an allowed redirect_uri | Recommended | Automatic |
| C204 | Sends an unguessable state | Required | Automatic |
| C205 | Uses PKCE with S256 | Required | Automatic |
| C206 | Uses a new PKCE challenge each time | Recommended | Automatic |
| C207 | Sends the me parameter | Recommended | Automatic |
| C208 | Publishes client metadata | Recommended | Automatic |
| C209 | client_uri is a prefix of client_id | Required | Automatic |
| C210 | Requests valid scopes | Required | Automatic |
Authorization responses
| C301 | Rejects a mismatched state | Required | Sign in with your client |
| C302 | Rejects a response without iss | Required | Sign in with your client |
| C303 | Rejects iss from another issuer | Required | Sign in with your client |
| C304 | Compares iss exactly | Required | Sign in with your client |
| C305 | Handles an error response | Required | Sign in with your client |
| C306 | Rejects an unsolicited response | Required | Sign in with your client |
| C307 | Does not accept a replayed response | Recommended | Sign in with your client |
Redemption and identity
| C401 | Redeems the code correctly | Required | Automatic |
| C402 | Verifies a different me on the same domain | Required | Sign in with your client |
| C403 | Rejects a me that uses another server | Required | Sign in with your client |
| C404 | Accepts a me on another domain that uses this server | Required | Sign in with your client |
| C405 | Accepts a me seen during discovery redirects | Required | Sign in with your client |
| C406 | Rejects a response without me | Required | Sign in with your client |
| C407 | Rejects an invalid me | Recommended | Sign in with your client |
| C408 | Does not trust profile information for identity | Required | Sign in with your client |
| C409 | Handles a token endpoint error | Required | Sign in with your client |
| C410 | Where sign-in-only codes are redeemed | Informational | Automatic |
Tokens
| C501 | Sends access tokens in the Authorization header | Recommended | Automatic |
| C502 | Refreshes expiring tokens | Optional | Automatic |
| C503 | Replaces rotated refresh tokens | Required | Automatic |
| C504 | Does not ask for more scope on refresh | Required | Automatic |
| C505 | Revokes tokens on sign-out | Informational | Automatic |