Server tests · Authorization requests
S211 Is not fooled by credentials in a URL
Required Browser check
What this test does
Sends a redirect_uri like https://client-host@other-host/, which looks like the client host but is not.
How it passes
Your server refuses it.
- Specification
- §4.2.2, §10.1
- Needs
- S106 Authorization endpoint is listed