Issue ouverte · Issue #1002 userinfo_endpoint is advertised as a relative URL · @rmdes
The authorization server metadata lists userinfo_endpoint as /auth/userinfo. Every other endpoint is made absolute by getEndpointUrls in packages/indiekit/lib/endpoints.js, but userinfoEndpoint (added in #938) isn’t in its list, so it reaches /.well-known/oauth-authorization-server as the relative default from endpoint-auth.
A client can’t fetch a relative URL from metadata. The IndieAuth test suite at dev.indieauth.rocks fails S116 (endpoints use https) and every userinfo test on it (S701–S703), see #967.