Server tests · Authorization requests
S209 Accepts a registered cross-origin redirect URI
Required Browser check
What this test does
Sends a request whose cross-origin redirect_uri is listed in the client metadata, which you cancel.
How it passes
Your server allows the request and redirects there with error=access_denied after you cancel.
- Specification
- §4.2.2
- Needs
- S106 Authorization endpoint is listed