authorization-endpoint-reviewer

maronnjapan's avatarfrom maronnjapan

Review test cases for Authorization Endpoint. Covers response_type=code, request parameters (scope, client_id, redirect_uri, state, nonce, prompt, display, max_age), and authorization response per OIDC Core 1.0 Section 3.1.2.

⭐0stars🔀0forks📁View on GitHub🕐Updated Dec 31, 2025
[Testing and QA]

When & Why to Use This Skill

The Authorization Endpoint Reviewer is a specialized technical tool designed to audit and validate test cases for OpenID Connect (OIDC) and OAuth 2.1 authentication flows. It ensures that authorization requests, mandatory parameters, and redirect URI logic strictly adhere to OIDC Core 1.0 and OAuth 2.1 specifications, helping developers maintain high security and compliance standards.

Use Cases

  • OIDC Compliance Auditing: Automatically verify if your Authorization Endpoint implementation aligns with OIDC Core 1.0 Section 3.1.2 and OAuth 2.1 Section 4.1 standards.
  • Security Vulnerability Screening: Identify gaps in error handling for invalid request parameters, such as missing response types, unauthorized redirect URIs, or insecure state management.
  • QA Test Plan Optimization: Streamline the creation and review of comprehensive test suites covering complex parameters like prompt (none, login, consent), display, and nonce.
  • Identity Provider (IdP) Integration: Ensure that custom-built or configured identity providers correctly handle authorization code flows and return the expected response components.
nameauthorization-endpoint-reviewer
descriptionReview test cases for Authorization Endpoint. Covers response_type=code, request parameters (scope, client_id, redirect_uri, state, nonce, prompt, display, max_age), and authorization response per OIDC Core 1.0 Section 3.1.2.

Authorization Endpoint Test Case Reviewer

Review test cases for Authorization Endpoint in OpenID Connect Basic OP.

Scope

  • Feature: Authorization Endpoint
  • Specifications: OIDC Core 1.0 Section 3.1.2; OAuth 2.1 Section 4.1
  • Profile: Basic OP (Authorization Code Flow, response_type=code)

Review Process

  1. Identify which authorization endpoint requirement the test targets
  2. Check against the checklist below
  3. Verify both success and error scenarios
  4. Ensure all mandatory parameters are tested
  5. Report gaps with specific spec section references

Response Type

OP-Response-code

Check Requirement Spec Reference
[ ] Accept authorization request with response_type=code OIDC Core 3.1.2.1
[ ] Return authorization code in query component of redirect URI OIDC Core 3.1.2.5
[ ] Include state in response if present in request OIDC Core 3.1.2.5

OP-Response-Missing

Check Requirement Spec Reference
[ ] Return error if response_type parameter is missing OAuth 2.1 4.1.2.1
[ ] Error code MUST be invalid_request OAuth 2.1 4.1.2.1

Mandatory Request Parameters

Check Parameter Requirement Spec Reference
[ ] scope MUST include openid OIDC Core 3.1.2.1
[ ] response_type REQUIRED OIDC Core 3.1.2.1
[ ] client_id REQUIRED OIDC Core 3.1.2.1
[ ] redirect_uri REQUIRED if multiple registered OIDC Core 3.1.2.1

Redirect URI Validation

Check Requirement Spec Reference
[ ] Exact string match comparison OAuth 2.1 4.1.3
[ ] Reject if redirect_uri doesn't match registered OIDC Core 3.1.2.1
[ ] MUST NOT redirect if redirect_uri invalid OAuth 2.1 4.1.2.1

State Parameter

Check Requirement Spec Reference
[ ] Return state unchanged if present in request OAuth 2.1 4.1.2
[ ] Include in both success and error responses OAuth 2.1 4.1.2

Nonce Parameter (Code Flow)

OP-Req-nonce

Check Requirement Spec Reference
[ ] Accept request without nonce when using code flow OIDC Core 3.1.2.1
[ ] If nonce provided, include in ID Token OIDC Core 3.1.3.6

Prompt Parameter (OIDC Core 15.1 - Mandatory)

Check Value Requirement Spec Reference
[ ] none No UI displayed; error if auth required OIDC Core 3.1.2.1
[ ] login Force re-authentication OIDC Core 3.1.2.1
[ ] consent Request consent even if previously given OIDC Core 3.1.2.1
[ ] select_account Prompt user to select account OIDC Core 3.1.2.1

prompt=none Error Cases

Check Condition Expected Error
[ ] User not authenticated login_required
[ ] Consent required consent_required
[ ] Account selection needed account_selection_required
[ ] Any interaction needed interaction_required

Display Parameter (OIDC Core 15.1 - Mandatory)

Check Requirement Spec Reference
[ ] Support display parameter OIDC Core 3.1.2.1
[ ] Values: page, popup, touch, wap OIDC Core 3.1.2.1

Optional Parameters (no error if unsupported)

Check Parameter Test ID Spec Reference
[ ] max_age OP-Req-max_age OIDC Core 3.1.2.1
[ ] ui_locales OP-Req-ui_locales OIDC Core 3.1.2.1
[ ] claims_locales OP-Req-claims_locales OIDC Core 3.1.2.1
[ ] acr_values OP-Req-acr_values OIDC Core 3.1.2.1
[ ] login_hint OP-Req-login_hint OIDC Core 3.1.2.1

Authorization Response (Success)

HTTP/1.1 302 Found
Location: https://client.example.org/cb?
  code=SplxlOBeZQQYbYS6WxSbIA
  &state=af0ifjsldkj
Check Requirement Spec Reference
[ ] Return code parameter OIDC Core 3.1.2.5
[ ] Return state if provided OIDC Core 3.1.2.5
[ ] Use query component for code flow OIDC Core 3.1.2.5

Test Case Categories

Response Type Tests

  • Valid: response_type=code accepted
  • Invalid: Missing response_type
  • Invalid: Unknown response_type

Redirect URI Tests

  • Valid: Exact match with registered URI
  • Invalid: Unregistered redirect_uri
  • Invalid: redirect_uri with extra query params
  • Invalid: redirect_uri with fragment

Scope Tests

  • Valid: scope=openid present
  • Invalid: Missing openid scope
  • Valid: Additional scopes (profile, email, etc.)

Prompt Parameter Tests

  • Valid: prompt=none (user authenticated)
  • Valid: prompt=login (force re-auth)
  • Valid: prompt=consent (force consent)
  • Valid: prompt=select_account
  • Error: prompt=none but login required
  • Error: prompt=none but consent required

State Parameter Tests

  • Valid: state returned unchanged
  • Valid: state included in error response
  • Valid: Request without state (optional)

Conformance Test IDs

Test ID Feature
OP-Response-code response_type=code
OP-Response-Missing Reject missing response_type
OP-nonce-NoReq-code Accept no nonce in code flow
OP-nonce-code Include nonce if requested
OP-redirect_uri-NotReg Reject unregistered redirect_uri
OP-Req-* Request parameter handling

Review Output Format

## Test Case: [Name]
### Target Feature: Authorization Endpoint - [specific aspect]
### Test ID: OP-[xxx]
### Spec Compliance:
- [x] Covers required behavior per [spec section]
- [ ] Missing: [specific requirement]
### Verdict: PASS / FAIL / PARTIAL
### Recommendations: [if any]