What this test does
Watches requests your client makes to the test server's userinfo endpoint.
How it passes
Tokens are sent as Authorization: Bearer, never in the URL.
- Specification
- RFC 6750 §2.1, RFC 9700 §4.3.2
- Needs
- C101 Discovers the server from an HTML link