What this test does
Checks CORS headers on the token endpoint.
How it passes
Access-Control-Allow-Origin: * is never combined with Access-Control-Allow-Credentials: true.
- Specification
- Fetch standard, RFC 9700
- Needs
- S107 Token endpoint is listed
Checks CORS headers on the token endpoint.
Access-Control-Allow-Origin: * is never combined with Access-Control-Allow-Credentials: true.