[Openid-specs-ab] Issue #183: The WWW-Authenticate Response Header at the request to userinfo is not parsed (openid/certification)

Ryo Ito issues-reply at bitbucket.org
Sun Nov 1 03:56:23 UTC 2015


New issue 183: The WWW-Authenticate Response Header at the request to userinfo is not parsed
https://bitbucket.org/openid/certification/issues/183/the-www-authenticate-response-header-at

Ryo Ito:

As a result of `Test ID: OP-OAuth-2nd-Revokes`, I got following warning.

    Test output
    
    __AuthorizationRequest:pre__
    [check-response-type]
    	status: OK
    	description: Checks that the asked for response type are among the supported
    [check-endpoint]
    	status: OK
    	description: Checks that the necessary endpoint exists at a server
    [-]
    	status: WARNING
    	info: Missing Error Response
    __X:==== END ====__

    12.945397 ------------ UserInfoRequest ------------
    12.945735 --> URL: https://idp.openidconnect.info/userinfo
    12.945742 --> BODY: None
    12.945754 --> HEADERS: {'Authorization': u'Bearer eyJhbGciOiJIUzI1NiJ9.eyJhdXRoX2lkIjo3LCJleHBpcmVkX29uIjoxNDQ2Mzk4NTIwfQ.iaqWgjA6yrh7_vw84taCVe_uzQGd2lJ5T3bCSFfRyxc'}
    14.019021 <-- STATUS: 401

For userInfo request using revoked access token, my op returns an error response using "WWW-Authenticate" header.

    $ curl -i -H "Authorization: Bearer invalid_access_token" https://idp.openidconnect.info/userinfo
    HTTP/1.1 401 Unauthorized
    Server: nginx/1.4.6 (Ubuntu)
    Date: Sun, 01 Nov 2015 03:48:55 GMT
    Content-Length: 0
    Connection: keep-alive
    WWW-Authenticate: Bearer error="invalid_token"

Does not test tool parse "WWW-Authenticate" header?




More information about the Openid-specs-ab mailing list