IndieAuth Rocks

82 tests

Server tests

These tests check an IndieAuth server: its discovery, authorization and token endpoints. This site acts as the client.

Test your server

Enter your profile URL. This site discovers your server, signs you in with it, then takes you through these tests one at a time.

Required a MUST in the spec; not doing it fails the test. Recommended a SHOULD or security best practice; not doing it is a warning. Optional or Informational never fail.

Discovery

S101 Profile URL is valid and can be fetched Required Automatic
S102 Advertises indieauth-metadata Required Automatic
S103 Link header and HTML agree Recommended Automatic
S104 Metadata is a JSON document Required Automatic
S105 Issuer identifier is valid Required Automatic
S106 Authorization endpoint is listed Required Automatic
S107 Token endpoint is listed Required Automatic
S108 Introspection endpoint is listed Recommended Automatic
S109 PKCE S256 is supported Required Automatic
S110 Advertises the iss response parameter Recommended Automatic
S111 Lists supported scopes Recommended Automatic
S112 Response and grant types are consistent Recommended Automatic
S113 Revocation needs no client authentication Recommended Automatic
S114 Metadata can be read by browser-based apps Informational Automatic
S115 Legacy endpoint links match the metadata Recommended Automatic
S116 Endpoints use https Required Automatic

Authorization requests

S201 Returns state unmodified Required Automatic
S202 Returns the iss parameter Required Automatic
S203 Issues an authorization code Required Needs approval
S204 Keeps the query string of the redirect URI Required Needs approval
S205 Fetches client information Recommended Automatic
S206 Consent screen identifies the application Required Asks you
S207 Reports a denied request to the client Required Browser check
S208 Refuses an unregistered cross-origin redirect URI Required Browser check
S209 Accepts a registered cross-origin redirect URI Required Browser check
S210 Matches redirect URIs exactly Required Browser check
S211 Is not fooled by credentials in a URL Required Browser check
S212 Ignores client metadata for a different client_id Required Browser check
S213 Rejects a repeated redirect_uri parameter Required Browser check
S214 Is not an open redirector Required Browser check
S215 Requires PKCE Recommended Browser check
S216 Refuses the plain PKCE method Recommended Browser check
S217 Refuses the implicit flow Required Browser check
S218 Handles a missing state parameter Recommended Browser check
S219 Refuses an invalid client_id Recommended Browser check
S220 Does not trust the me parameter Required Browser check

Code redemption

S301 Exchanges a code at the token endpoint Required Needs approval
S302 Codes can only be used once Required Automatic
S303 Reusing a code revokes its tokens Recommended Automatic
S304 Codes expire extended Required Needs approval
S310 Refuses a wrong code_verifier Required Needs approval
S311 Refuses a missing code_verifier Required Needs approval
S312 Refuses a code presented by another client Required Needs approval
S313 Refuses a mismatched redirect_uri Required Needs approval
S320 Exchanges a code at the authorization endpoint Required Needs approval
S321 No access token without a scope extended Required Needs approval
S322 Refuses a verifier for a code issued without PKCE extended Required Needs approval
S330 Refuses an unknown code Required Automatic
S331 Refuses missing or unsupported grant types Required Automatic
S332 Errors are JSON with an error code Required Automatic
S333 Token endpoint refuses GET requests Recommended Automatic
S334 Token endpoint supports CORS preflight Informational Automatic

Token responses

S401 Token response is JSON Required Automatic
S402 Includes an access token Required Automatic
S403 Token type is Bearer Recommended Automatic
S404 Returns a valid me Required Automatic
S405 The returned me is verified Required Automatic
S406 Token responses are not cached Required Automatic
S407 Says when the token expires Recommended Automatic
S408 Reports the granted scope Recommended Automatic
S409 Profile information is well formed Recommended Automatic
S410 Access tokens are hard to guess Recommended Automatic

Refresh tokens

S501 Refreshes an access token Required Automatic
S502 Refuses a refresh by another client Required Automatic
S503 Refuses to add scopes on refresh Required Automatic
S504 Old refresh tokens stop working after rotation Recommended Automatic
S505 Refresh token reuse revokes the grant Recommended Automatic

Revocation

S601 Revokes an access token Required Automatic
S602 Revoked tokens stop working Required Automatic
S603 Revokes a refresh token Required Automatic
S604 Revoking an unknown token succeeds Required Automatic

Userinfo

S701 Returns profile information Required Automatic
S702 Refuses a request without a token Recommended Automatic
S703 Refuses an invalid token Recommended Automatic

Introspection

S801 Introspection requires authorization Required Automatic
S802 Refused introspection reveals nothing Required Automatic
S803 Describes an active token extended Required Asks you
S804 Describes an invalid token extended Required Asks you

Security hygiene

S901 Token endpoint requires TLS Recommended Automatic
S902 Authorization pages cannot be framed Recommended Automatic
S905 Tokens never appear in URLs Required Automatic
S906 No credentialed wildcard CORS Recommended Automatic