Client tests · Authorization responses
C306 Rejects an unsolicited response
Required Sign in with your client
What this test does
A link sends your browser straight to your redirect_uri with a valid code and a state your client never created.
How it passes
Your client does not redeem the code (this prevents login CSRF).
- Specification
- §5.2.1, RFC 9700 §4.7
- Needs
- C101 Discovers the server from an HTML link