search

openid-certification / oidctest

THE CERTIFICATION TEST SUITE HAS BEEN MIGRATED TO A NEW SERVICE https://www.certificatinon.openid.net
Other
50 stars 15 forks source link

state parameter must be returned in error responses #152

Open zandbelt opened 5 years ago

zandbelt commented 5 years ago

Someone reported today (f2f) that the test suite currently does not test for the state parameter and value being returned by the OP on an authentication error response.

  1. We should verify this statement; I believe this is not an existing test, but it may or may not be implicitly done as part of other tests. In any case it is a MUST in the spec.
  2. If true, we should add a proper test that sends an authentication request - with a state parameter - that triggers an error on the OP and verifies that the same state parameter/value is passed back on the error response.