What this test does
Sends response_type=token.
How it passes
Your server refuses the request and never puts a token in the URL.
- Specification
- §5.2, RFC 9700 §2.1.2
- Needs
- S106 Authorization endpoint is listed
Sends response_type=token.
Your server refuses the request and never puts a token in the URL.