What this test does
When the access token is a JWT, checks its header.
How it passes
typ is "at+jwt", so it cannot be confused with an ID token, and alg is a real signing algorithm.
- Specification
- RFC 9068 §2.1
- Needs
- S420 Access token format
When the access token is a JWT, checks its header.
typ is "at+jwt", so it cannot be confused with an ID token, and alg is a real signing algorithm.