rohe / oidctest

Test framework for testing OpenID Connect entities
Other
29 stars 27 forks source link

oidctest Issue #7. #124

Closed sozkan closed 5 years ago

sozkan commented 5 years ago

I added a try-except to prevent abrupt failures when response code is unexpected. Also added http response code checks to OP-OAuth-2nd and OP-OAuth-2nd-30s.

How to test it:

@rohe OP-OAuth-2nd-30s returns an error status while OP-OAuth-2nd returns a warning in case of an invalid_grant response. Should they be consistent? I can add another commit if we would like to make them consistent. Let me know if any additional changes are needed.

rohe commented 5 years ago

@sozkan There is a reason behind them not being consistent. Why the standard says SHOULD and not MUST in section 10.5 of RFC6749 was because the speed of light :-) If we follow the same reasoning as RFC6749 OP-OAuth-2nd may fail due to the speed of light but OP-OAuth-2nd-30s can not. That's why one is a warning and the other an error.