Conversation

• I Indiekit Demo Indiekit Demo remote 3 days ago You are here

  💬 @rmdes — discussion #967 : IndieAuth Spec Testing

  Reponse de discussion · Discussion #967 IndieAuth Spec Testing · @rmdes

  I ran it against rmendes.net, which runs endpoint-auth from main (no code difference): 46 passed, 11 failed, 16 warnings, 11 skipped. https://dev.indieauth.rocks/implementations/2

  Three look like small fixes:

  • userinfo_endpoint is advertised as /auth/userinfo, a relative URL: getEndpointUrls in packages/indiekit/lib/endpoints.js doesn’t list userinfoEndpoint. That fails S116 and every userinfo test.
  • A code issued with a challenge but redeemed without code_verifier gives a 500 (createHash().update(undefined)), not a 400.
  • The introspection endpoint answers without authorization (S801, S802).

  Bigger ones: a code can be redeemed twice (S302), the consent screen has no deny button (S207), a registered cross-origin redirect_uri is refused (S209), and there is no refresh or revocation (#535).

  Ouvrir sur GitHub →

  source