Test detail

Test Name	oidcc-refresh-token
Variant	client_auth_type=client_secret_basic, server_metadata=discovery, response_type=code, response_mode=default, client_registration=static_client
Test ID	9wCcblk5hXQgK4w https://www.certification.openid.net/log-detail.html?public=true&log=9wCcblk5hXQgK4w
Created	2026-07-18T15:02:38.246099657Z
Description	CodeB OIDC OP - Basic Certification Profile - 2026-07-18
Test Version	5.2.0
Test Owner	111972090125569840012 https://accounts.google.com
Plan ID	RRxhrmgabfcym https://www.certification.openid.net/plan-detail.html?public=true&plan=RRxhrmgabfcym
Exported From	https://www.certification.openid.net
Exported By	111972090125569840012 https://accounts.google.com
Suite Version	5.2.0
Exported	2026-07-18 16:35:01 (UTC)

2026-07-18 15:02:38

(8) More

INFO

TEST-RUNNER

Test instance 9wCcblk5hXQgK4w created

baseUrl	https://www.certification.openid.net/test/a/codeb
variant	{ "client_auth_type": "client_secret_basic", "response_type": "code", "server_metadata": "discovery", "response_mode": "default", "client_registration": "static_client" }
alias	codeb
description	CodeB OIDC OP - Basic Certification Profile - 2026-07-18
planId	RRxhrmgabfcym
config	{ "alias": "codeb", "description": "CodeB OIDC OP - Basic Certification Profile - 2026-07-18", "server": { "discoveryUrl": "https://phone.codeb.io/.well-known/openid-configuration", "login_hint": "claude" }, "client": { "client_id": "oidf-conf-basic", "client_secret": "W6Oag_SfF8T9CKjyQlBz3fSyRCPN60bpa6vL4456yro" }, "client_secret_post": { "client_id": "client_secret_post", "client_secret": "cRZGUg0oa9MoMEOgo5iXRjg9Z0AJaAf97IrP7wURYpk" }, "client2": { "client_id": "client_secret_basic", "client_secret": "FdL-0qSC8oVVy9Vh1Et2Tx7owpdukS643i-NWaysQvY" } }
baseMtlsUrl	https://mtls-www.certification.openid.net/test-mtls/a/codeb
testName	oidcc-refresh-token

2026-07-18 15:02:38

(1) More

SUCCESS

CreateRedirectUri

Created redirect URI

redirect_uri

https://www.certification.openid.net/test/a/codeb/callback

2026-07-18 15:02:38

(4) More

GetDynamicServerConfiguration

HTTP request

request_uri	https://phone.codeb.io/.well-known/openid-configuration
request_method	GET
request_headers	{ "Accept": "text/plain, application/json, application/yaml, application/+json, /*", "Content-Length": "0" }
request_body

2026-07-18 15:02:38

(4) More

RESPONSE

GetDynamicServerConfiguration

HTTP response

response_status_code	200 OK
response_status_text	OK
response_headers	{ "cache-control": "private, no-store,no-store, no-cache, must-revalidate, max-age\u003d0", "pragma": "no-cache", "content-type": "application/json; charset\u003dutf-8", "expires": "0", "vary": "Origin", "access-control-allow-origin": "*", "access-control-allow-methods": "GET, POST, OPTIONS", "access-control-allow-headers": "Content-Type, Authorization, DPoP, X-Requested-With", "access-control-max-age": "600", "x-aspnet-version": "4.0.30319", "referrer-policy": "no-referrer", "x-content-type-options": "nosniff", "permissions-policy": "camera\u003d(self), microphone\u003d(self), display-capture\u003d(self)", "strict-transport-security": "max-age\u003d63072000; includeSubDomains", "date": "Sat, 18 Jul 2026 15:02:38 GMT", "content-length": "2074" }
response_body	{"issuer":"https://phone.codeb.io","authorization_endpoint":"https://phone.codeb.io/oauth2/v1/authorize","token_endpoint":"https://phone.codeb.io/oauth2/v1/token","userinfo_endpoint":"https://phone.codeb.io/oauth2/v1/userinfo","revocation_endpoint":"https://phone.codeb.io/oauth2/v1/revoke","introspection_endpoint":"https://phone.codeb.io/oauth2/v1/introspect","jwks_uri":"https://phone.codeb.io/.well-known/jwks.json","end_session_endpoint":"https://phone.codeb.io/oauth2/v1/logout","response_types_supported":["code"],"subject_types_supported":["public"],"id_token_signing_alg_values_supported":["RS256"],"scopes_supported":["openid","profile","email","groups","phone","address"],"token_endpoint_auth_methods_supported":["none","client_secret_basic","client_secret_post"],"introspection_endpoint_auth_methods_supported":["none","client_secret_post"],"revocation_endpoint_auth_methods_supported":["none","client_secret_post"],"claims_supported":["sub","iss","aud","exp","iat","auth_time","nonce","name","preferred_username","email","email_verified","phone_number","phone_number_verified","address","locale","role","groups","given_name","family_name","middle_name","birthdate","gender","nationality","vc"],"code_challenge_methods_supported":["S256"],"grant_types_supported":["authorization_code","refresh_token","urn:ietf:params:oauth:grant-type:jwt-bearer"],"amr_values_supported":["pwd","hwk","mfa","swk","otp"],"acr_values_supported":["urn:codeb:acr:pwd","urn:codeb:acr:hwk","urn:codeb:acr:hwk-mfa","urn:codeb:acr:mfa","eudi:pid:high","eudi:pid:substantial","urn:codeb:vc:member"],"vp_formats_supported":[],"response_modes_supported":["query"],"claim_types_supported":["normal"],"claims_parameter_supported":false,"request_parameter_supported":false,"request_uri_parameter_supported":false,"require_request_uri_registration":false,"display_values_supported":["page"],"ui_locales_supported":["en","de"],"op_policy_uri":"https://phone.codeb.io/privacy.html","op_tos_uri":"https://phone.codeb.io/imprint.html","service_documentation":"https://phone.codeb.io/api-docs.html"}

2026-07-18 15:02:38

(32) More

SUCCESS

GetDynamicServerConfiguration

Successfully parsed server configuration

issuer	https://phone.codeb.io
authorization_endpoint	https://phone.codeb.io/oauth2/v1/authorize
token_endpoint	https://phone.codeb.io/oauth2/v1/token
userinfo_endpoint	https://phone.codeb.io/oauth2/v1/userinfo
revocation_endpoint	https://phone.codeb.io/oauth2/v1/revoke
introspection_endpoint	https://phone.codeb.io/oauth2/v1/introspect
jwks_uri	https://phone.codeb.io/.well-known/jwks.json
end_session_endpoint	https://phone.codeb.io/oauth2/v1/logout
response_types_supported	[ "code" ]
subject_types_supported	[ "public" ]
id_token_signing_alg_values_supported	[ "RS256" ]
scopes_supported	[ "openid", "profile", "email", "groups", "phone", "address" ]
token_endpoint_auth_methods_supported	[ "none", "client_secret_basic", "client_secret_post" ]
introspection_endpoint_auth_methods_supported	[ "none", "client_secret_post" ]
revocation_endpoint_auth_methods_supported	[ "none", "client_secret_post" ]
claims_supported	[ "sub", "iss", "aud", "exp", "iat", "auth_time", "nonce", "name", "preferred_username", "email", "email_verified", "phone_number", "phone_number_verified", "address", "locale", "role", "groups", "given_name", "family_name", "middle_name", "birthdate", "gender", "nationality", "vc" ]
code_challenge_methods_supported	[ "S256" ]
grant_types_supported	[ "authorization_code", "refresh_token", "urn:ietf:params:oauth:grant-type:jwt-bearer" ]
amr_values_supported	[ "pwd", "hwk", "mfa", "swk", "otp" ]
acr_values_supported	[ "urn:codeb:acr:pwd", "urn:codeb:acr:hwk", "urn:codeb:acr:hwk-mfa", "urn:codeb:acr:mfa", "eudi:pid:high", "eudi:pid:substantial", "urn:codeb:vc:member" ]
vp_formats_supported	[]
response_modes_supported	[ "query" ]
claim_types_supported	[ "normal" ]
claims_parameter_supported	false
request_parameter_supported	false
request_uri_parameter_supported	false
require_request_uri_registration	false
display_values_supported	[ "page" ]
ui_locales_supported	[ "en", "de" ]
op_policy_uri	https://phone.codeb.io/privacy.html
op_tos_uri	https://phone.codeb.io/imprint.html
service_documentation	https://phone.codeb.io/api-docs.html

2026-07-18 15:02:38

(1) More

SUCCESS

CheckServerConfiguration

Found required server configuration keys

required

[
  "authorization_endpoint",
  "token_endpoint",
  "issuer"
]

2026-07-18 15:02:38

(4) More

SUCCESS

ExtractTLSTestValuesFromServerConfiguration

Extracted TLS information from authorization server configuration

registration_endpoint
authorization_endpoint	{ "testHost": "phone.codeb.io", "testPort": 443 }
token_endpoint	{ "testHost": "phone.codeb.io", "testPort": 443 }
userinfo_endpoint	{ "testHost": "phone.codeb.io", "testPort": 443 }

2026-07-18 15:02:38

(1) More

FetchServerKeys

Fetching server key

jwks_uri

https://phone.codeb.io/.well-known/jwks.json

2026-07-18 15:02:38

(4) More

FetchServerKeys

HTTP request

request_uri	https://phone.codeb.io/.well-known/jwks.json
request_method	GET
request_headers	{ "Accept": "text/plain, application/json, application/yaml, application/+json, /*", "Content-Length": "0" }
request_body

2026-07-18 15:02:39

(4) More

RESPONSE

FetchServerKeys

HTTP response

response_status_code	200 OK
response_status_text	OK
response_headers	{ "cache-control": "private, no-store,no-store, no-cache, must-revalidate, max-age\u003d0", "pragma": "no-cache", "content-type": "application/json; charset\u003dutf-8", "expires": "0", "vary": "Origin", "access-control-allow-origin": "*", "access-control-allow-methods": "GET, POST, OPTIONS", "access-control-allow-headers": "Content-Type, Authorization, DPoP, X-Requested-With", "access-control-max-age": "600", "x-aspnet-version": "4.0.30319", "referrer-policy": "no-referrer", "x-content-type-options": "nosniff", "permissions-policy": "camera\u003d(self), microphone\u003d(self), display-capture\u003d(self)", "strict-transport-security": "max-age\u003d63072000; includeSubDomains", "date": "Sat, 18 Jul 2026 15:02:38 GMT", "content-length": "435" }
response_body	{"keys":[{"kty":"RSA","use":"sig","alg":"RS256","kid":"ee3dae3ffb874034","n":"zMFT1RyDifG0bk56Yak8et9ICRQyOc2RgTSG_QVL2TlpEfdKnROTsJ3mMXS6ig4To3cfUkm4cXTmaIjCypJG2Lt7WImYBMcaf8X57v2FBIt-eJSDfWyZ_dLq2_kxSDNVjF4Bas7WMQPQ_e2RX94kntnG2yxIvLoPnLQlOj5BbqbwtXErg0bL9IE93sS3X6R8RcbI3MapS_vJCLwEhXdpjR9g6I14PzLFS5Z8KvxbgitiuECjZGx-R-2Rg7gMpjS_3LZWPdNmYGmjU2VF1XA8ExfNACbxU7Dkf4QYGhVEc9dStJJxcKmfha6oyOtjU7cs1S1eVHZy-jnN0O6_5K1JlQ","e":"AQAB"}]}

2026-07-18 15:02:39

(1) More

FetchServerKeys

Found JWK set string

jwk_string

{"keys":[{"kty":"RSA","use":"sig","alg":"RS256","kid":"ee3dae3ffb874034","n":"zMFT1RyDifG0bk56Yak8et9ICRQyOc2RgTSG_QVL2TlpEfdKnROTsJ3mMXS6ig4To3cfUkm4cXTmaIjCypJG2Lt7WImYBMcaf8X57v2FBIt-eJSDfWyZ_dLq2_kxSDNVjF4Bas7WMQPQ_e2RX94kntnG2yxIvLoPnLQlOj5BbqbwtXErg0bL9IE93sS3X6R8RcbI3MapS_vJCLwEhXdpjR9g6I14PzLFS5Z8KvxbgitiuECjZGx-R-2Rg7gMpjS_3LZWPdNmYGmjU2VF1XA8ExfNACbxU7Dkf4QYGhVEc9dStJJxcKmfha6oyOtjU7cs1S1eVHZy-jnN0O6_5K1JlQ","e":"AQAB"}]}

2026-07-18 15:02:39

(1) More

SUCCESS

FetchServerKeys

Found server JWK set

server_jwks

{
  "keys": [
    {
      "kty": "RSA",
      "use": "sig",
      "alg": "RS256",
      "kid": "ee3dae3ffb874034",
      "n": "zMFT1RyDifG0bk56Yak8et9ICRQyOc2RgTSG_QVL2TlpEfdKnROTsJ3mMXS6ig4To3cfUkm4cXTmaIjCypJG2Lt7WImYBMcaf8X57v2FBIt-eJSDfWyZ_dLq2_kxSDNVjF4Bas7WMQPQ_e2RX94kntnG2yxIvLoPnLQlOj5BbqbwtXErg0bL9IE93sS3X6R8RcbI3MapS_vJCLwEhXdpjR9g6I14PzLFS5Z8KvxbgitiuECjZGx-R-2Rg7gMpjS_3LZWPdNmYGmjU2VF1XA8ExfNACbxU7Dkf4QYGhVEc9dStJJxcKmfha6oyOtjU7cs1S1eVHZy-jnN0O6_5K1JlQ",
      "e": "AQAB"
    }
  ]
}

2026-07-18 15:02:39

(1) More

SUCCESS

CheckServerKeysIsValid

Server JWKs is valid

server_jwks

{
  "keys": [
    {
      "kty": "RSA",
      "use": "sig",
      "alg": "RS256",
      "kid": "ee3dae3ffb874034",
      "n": "zMFT1RyDifG0bk56Yak8et9ICRQyOc2RgTSG_QVL2TlpEfdKnROTsJ3mMXS6ig4To3cfUkm4cXTmaIjCypJG2Lt7WImYBMcaf8X57v2FBIt-eJSDfWyZ_dLq2_kxSDNVjF4Bas7WMQPQ_e2RX94kntnG2yxIvLoPnLQlOj5BbqbwtXErg0bL9IE93sS3X6R8RcbI3MapS_vJCLwEhXdpjR9g6I14PzLFS5Z8KvxbgitiuECjZGx-R-2Rg7gMpjS_3LZWPdNmYGmjU2VF1XA8ExfNACbxU7Dkf4QYGhVEc9dStJJxcKmfha6oyOtjU7cs1S1eVHZy-jnN0O6_5K1JlQ",
      "e": "AQAB"
    }
  ]
}

Validate the JWK set in server JWKS

2026-07-18 15:02:39

(1) More

SUCCESS

MapJwksToValidationLocation

Selected the JWK set in server JWKS for validation

jwks

{
  "keys": [
    {
      "kty": "RSA",
      "use": "sig",
      "alg": "RS256",
      "kid": "ee3dae3ffb874034",
      "n": "zMFT1RyDifG0bk56Yak8et9ICRQyOc2RgTSG_QVL2TlpEfdKnROTsJ3mMXS6ig4To3cfUkm4cXTmaIjCypJG2Lt7WImYBMcaf8X57v2FBIt-eJSDfWyZ_dLq2_kxSDNVjF4Bas7WMQPQ_e2RX94kntnG2yxIvLoPnLQlOj5BbqbwtXErg0bL9IE93sS3X6R8RcbI3MapS_vJCLwEhXdpjR9g6I14PzLFS5Z8KvxbgitiuECjZGx-R-2Rg7gMpjS_3LZWPdNmYGmjU2VF1XA8ExfNACbxU7Dkf4QYGhVEc9dStJJxcKmfha6oyOtjU7cs1S1eVHZy-jnN0O6_5K1JlQ",
      "e": "AQAB"
    }
  ]
}

2026-07-18 15:02:39

(1) More

SUCCESS

RFC7517-1.1

EnsureJwksHasNoPrivateOrSymmetricKeyMaterial

The JWK set in server JWKS contains only public key material

jwks_source

server JWKS

2026-07-18 15:02:39

(1) More

SUCCESS

RFC7517-1.1

ValidateJwksStructure

The JWK set in server JWKS is structurally valid

jwks_source

server JWKS

2026-07-18 15:02:39

(1) More

SUCCESS

RFC7517-1.1

ParseUsableJwksKeys

All usable keys in the JWK set in server JWKS parse successfully

jwks_source

server JWKS

2026-07-18 15:02:39

(1) More

SUCCESS

RFC7517-1.1

WarnOnUnusableJwksKeys

All keys in the JWK set in server JWKS use a supported key type, curve and algorithm

jwks_source

server JWKS

2026-07-18 15:02:39	SUCCESS OIDCC-10.1	CheckForKeyIdInServerJWKs All keys contain kids

2026-07-18 15:02:39

(1) More

SUCCESS

RFC7517-4.5

CheckDistinctKeyIdValueInServerJWKs

Distinct 'kid' value in all keys of server_jwks

see	https://bitbucket.org/openid/connect/issues/1127

2026-07-18 15:02:39

(2) More

SUCCESS

GetStaticClientConfiguration

Found a static client object

client_id	oidf-conf-basic
client_secret	W6Oag_SfF8T9CKjyQlBz3fSyRCPN60bpa6vL4456yro

2026-07-18 15:02:39

(3) More

INFO

RFC7517-1.1

ValidateClientJWKsPrivatePart

Skipped evaluation due to missing required element: client jwks

mapped
path	jwks
object	client

2026-07-18 15:02:39

(3) More

INFO

ExtractJWKsFromStaticClientConfiguration

Skipped evaluation due to missing required element: client jwks

mapped
path	jwks
object	client

2026-07-18 15:02:39

(3) More

INFO

RFC7517-4.5

CheckDistinctKeyIdValueInClientJWKs

Skipped evaluation due to missing required element: client jwks

mapped
path	jwks
object	client

2026-07-18 15:02:39

(1) More

SetScopeInClientConfigurationToOpenId

Set scope in client configuration to "openid"

scope

openid

2026-07-18 15:02:39

(1) More

SetScopeInClientConfigurationToOpenIdOfflineAccessIfServerSupportsOfflineAccess

scopes supported does not contain 'offline_access' so not adding it to the list of scopes to be requested

scopes_supported

[
  "openid",
  "profile",
  "email",
  "groups",
  "phone",
  "address"
]

2026-07-18 15:02:39

(3) More

SUCCESS

EnsureServerConfigurationSupportsClientSecretBasic

Contents of 'token_endpoint_auth_methods_supported' in discovery document matches expectations.

actual	[ "none", "client_secret_basic", "client_secret_post" ]
minimum_matches_required	1
expected	[ "client_secret_basic" ]

2026-07-18 15:02:39

(2) More

SUCCESS

GetStaticClient2Configuration

Found a static second client object

client_id	client_secret_basic
client_secret	FdL-0qSC8oVVy9Vh1Et2Tx7owpdukS643i-NWaysQvY

2026-07-18 15:02:39

(3) More

INFO

RFC7517-1.1

ValidateClientJWKsPrivatePart

Skipped evaluation due to missing required element: client jwks

mapped
path	jwks
object	client

2026-07-18 15:02:39

(3) More

INFO

ExtractJWKsFromStaticClientConfiguration

Skipped evaluation due to missing required element: client jwks

mapped
path	jwks
object	client

2026-07-18 15:02:39

(3) More

INFO

RFC7517-4.5

CheckDistinctKeyIdValueInClientJWKs

Skipped evaluation due to missing required element: client jwks

mapped
path	jwks
object	client

2026-07-18 15:02:39

(1) More

SetScopeInClientConfigurationToOpenId

Set scope in client configuration to "openid"

scope

openid

2026-07-18 15:02:39

(1) More

SetScopeInClientConfigurationToOpenIdOfflineAccessIfServerSupportsOfflineAccess

scopes supported does not contain 'offline_access' so not adding it to the list of scopes to be requested

scopes_supported

[
  "openid",
  "profile",
  "email",
  "groups",
  "phone",
  "address"
]

2026-07-18 15:02:39

(3) More

SUCCESS

EnsureServerConfigurationSupportsClientSecretBasic

Contents of 'token_endpoint_auth_methods_supported' in discovery document matches expectations.

actual	[ "none", "client_secret_basic", "client_secret_post" ]
minimum_matches_required	1
expected	[ "client_secret_basic" ]

2026-07-18 15:02:39

(1) More

SUCCESS

SetProtectedResourceUrlToUserInfoEndpoint

userinfo_endpoint will be used to test access token. The user info is not a mandatory to implement feature in the OpenID Connect specification, but is mandatory for certification.

protected_resource_url

https://phone.codeb.io/oauth2/v1/userinfo

2026-07-18 15:02:39		oidcc-refresh-token Setup Done

Make request to authorization endpoint

2026-07-18 15:02:39

(3) More

SUCCESS

CreateAuthorizationEndpointRequestFromClientInformation

Created authorization endpoint request

client_id	oidf-conf-basic
redirect_uri	https://www.certification.openid.net/test/a/codeb/callback
scope	openid

2026-07-18 15:02:39

(2) More

CreateRandomStateValue

Created state value

state	5YGL3v8rLt
requested_state_length	10

2026-07-18 15:02:39

(4) More

SUCCESS

AddStateToAuthorizationEndpointRequest

Added state parameter to request

client_id	oidf-conf-basic
redirect_uri	https://www.certification.openid.net/test/a/codeb/callback
scope	openid
state	5YGL3v8rLt

2026-07-18 15:02:39

(2) More

CreateRandomNonceValue

Created nonce value

requested_nonce_length	10
nonce	4WHooL4oUW

2026-07-18 15:02:39

(5) More

SUCCESS

AddNonceToAuthorizationEndpointRequest

Added nonce parameter to request

client_id	oidf-conf-basic
redirect_uri	https://www.certification.openid.net/test/a/codeb/callback
scope	openid
state	5YGL3v8rLt
nonce	4WHooL4oUW

2026-07-18 15:02:39

(6) More

SUCCESS

SetAuthorizationEndpointRequestResponseTypeFromEnvironment

Added response_type parameter to request

client_id	oidf-conf-basic
redirect_uri	https://www.certification.openid.net/test/a/codeb/callback
scope	openid
state	5YGL3v8rLt
nonce	4WHooL4oUW
response_type	code

2026-07-18 15:02:39	SUCCESS OIDCC-11	AddPromptConsentToAuthorizationEndpointRequestIfScopeContainsOfflineAccess Not adding prompt=consent as the scope in the configuration does not contain offline_access

2026-07-18 15:02:39

(2) More

SUCCESS

BuildPlainRedirectToAuthorizationEndpoint

Sending to authorization endpoint

auth_request

{
  "client_id": "oidf-conf-basic",
  "redirect_uri": "https://www.certification.openid.net/test/a/codeb/callback",
  "scope": "openid",
  "state": "5YGL3v8rLt",
  "nonce": "4WHooL4oUW",
  "response_type": "code"
}

redirect_to_authorization_endpoint

https://phone.codeb.io/oauth2/v1/authorize?client_id=oidf-conf-basic&nonce=4WHooL4oUW&redirect_uri=https://www.certification.openid.net/test/a/codeb/callback&response_type=code&scope=openid&state=5YGL3v8rLt

2026-07-18 15:02:39

(2) More

REDIRECT

oidcc-refresh-token

Redirecting to authorization endpoint

method

GET

redirect_to

https://phone.codeb.io/oauth2/v1/authorize?client_id=oidf-conf-basic&nonce=4WHooL4oUW&redirect_uri=https://www.certification.openid.net/test/a/codeb/callback&response_type=code&scope=openid&state=5YGL3v8rLt

2026-07-18 15:02:43

(12) More

INCOMING

oidcc-refresh-token

Incoming HTTP request to /test/a/codeb/callback

incoming_headers	{ "host": "www.certification.openid.net", "sec-ch-ua": "\"Google Chrome\";v\u003d\"149\", \"Chromium\";v\u003d\"149\", \"Not)A;Brand\";v\u003d\"24\"", "sec-ch-ua-mobile": "?0", "sec-ch-ua-platform": "\"Windows\"", "upgrade-insecure-requests": "1", "user-agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36", "accept": "text/html,application/xhtml+xml,application/xml;q\u003d0.9,image/avif,image/webp,image/apng,/;q\u003d0.8,application/signed-exchange;v\u003db3;q\u003d0.7", "sec-fetch-site": "cross-site", "sec-fetch-mode": "navigate", "sec-fetch-dest": "document", "accept-encoding": "gzip, deflate, br, zstd", "accept-language": "en-GB,en;q\u003d0.9,en-US;q\u003d0.8,de;q\u003d0.7", "cookie": "JSESSIONID\u003d68A8301AB4862BB7D9ECEFA93BCE360D", "connection": "close" }
incoming_path	/test/a/codeb/callback
incoming_body_form_params
incoming_method	GET
incoming_tls_version	TLSv1.2
incoming_tls_cert
incoming_query_string_params	{ "code": "Hhu3BvEkgWTYPPv5XCoxtbKALhq04zXgDR-vcAEsQ78", "state": "5YGL3v8rLt" }
incoming_body
incoming_tls_chain	[ "CONFORMANCE_SUITE_JSON_NULL", "CONFORMANCE_SUITE_JSON_NULL", "CONFORMANCE_SUITE_JSON_NULL", "CONFORMANCE_SUITE_JSON_NULL", "CONFORMANCE_SUITE_JSON_NULL", "CONFORMANCE_SUITE_JSON_NULL" ]
incoming_body_json_parse_error
incoming_tls_cipher	ECDHE-RSA-AES128-GCM-SHA256
incoming_body_json

2026-07-18 15:02:43

(1) More

SUCCESS

CreateRandomImplicitSubmitUrl

Created random implicit submission URL

implicit_submit

{
  "path": "implicit/8JLTNbZwEpvSfUkSWrlc",
  "fullUrl": "https://www.certification.openid.net/test/a/codeb/implicit/8JLTNbZwEpvSfUkSWrlc"
}

2026-07-18 15:02:43

(2) More

OUTGOING

oidcc-refresh-token

Response to HTTP request to test instance 9wCcblk5hXQgK4w

outgoing

ModelAndView [view="implicitCallback"; model={implicitSubmitUrl=https://www.certification.openid.net/test/a/codeb/implicit/8JLTNbZwEpvSfUkSWrlc, returnUrl=/log-detail.html?log=9wCcblk5hXQgK4w}]

outgoing_path

callback

2026-07-18 15:02:43

(12) More

INCOMING

oidcc-refresh-token

Incoming HTTP request to /test/a/codeb/implicit/8JLTNbZwEpvSfUkSWrlc

incoming_headers	{ "host": "www.certification.openid.net", "sec-ch-ua-platform": "\"Windows\"", "user-agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36", "sec-ch-ua": "\"Google Chrome\";v\u003d\"149\", \"Chromium\";v\u003d\"149\", \"Not)A;Brand\";v\u003d\"24\"", "content-type": "text/plain", "sec-ch-ua-mobile": "?0", "accept": "/", "origin": "https://www.certification.openid.net", "sec-fetch-site": "same-origin", "sec-fetch-mode": "cors", "sec-fetch-dest": "empty", "referer": "https://www.certification.openid.net/test/a/codeb/callback?code\u003dHhu3BvEkgWTYPPv5XCoxtbKALhq04zXgDR-vcAEsQ78\u0026state\u003d5YGL3v8rLt", "accept-encoding": "gzip, deflate, br, zstd", "accept-language": "en-GB,en;q\u003d0.9,en-US;q\u003d0.8,de;q\u003d0.7", "cookie": "JSESSIONID\u003d68A8301AB4862BB7D9ECEFA93BCE360D", "content-length": "0", "connection": "close" }
incoming_path	/test/a/codeb/implicit/8JLTNbZwEpvSfUkSWrlc
incoming_body_form_params
incoming_method	POST
incoming_tls_version	TLSv1.2
incoming_tls_cert
incoming_query_string_params	{}
incoming_body
incoming_tls_chain	[ "CONFORMANCE_SUITE_JSON_NULL", "CONFORMANCE_SUITE_JSON_NULL", "CONFORMANCE_SUITE_JSON_NULL", "CONFORMANCE_SUITE_JSON_NULL", "CONFORMANCE_SUITE_JSON_NULL", "CONFORMANCE_SUITE_JSON_NULL" ]
incoming_body_json_parse_error
incoming_tls_cipher	ECDHE-RSA-AES128-GCM-SHA256
incoming_body_json

2026-07-18 15:02:43

(4) More

OUTGOING

oidcc-refresh-token

Response to HTTP request to test instance 9wCcblk5hXQgK4w

outgoing_status_code	204
outgoing_body
outgoing_headers	{}
outgoing_path	implicit/8JLTNbZwEpvSfUkSWrlc

2026-07-18 15:02:43	SUCCESS	ExtractImplicitHashToCallbackResponse implicit_hash is empty

2026-07-18 15:02:43

(5) More

REDIRECT-IN

oidcc-refresh-token

Authorization endpoint response captured

url_query	{ "code": "Hhu3BvEkgWTYPPv5XCoxtbKALhq04zXgDR-vcAEsQ78", "state": "5YGL3v8rLt" }
headers	{ "host": "www.certification.openid.net", "sec-ch-ua": "\"Google Chrome\";v\u003d\"149\", \"Chromium\";v\u003d\"149\", \"Not)A;Brand\";v\u003d\"24\"", "sec-ch-ua-mobile": "?0", "sec-ch-ua-platform": "\"Windows\"", "upgrade-insecure-requests": "1", "user-agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36", "accept": "text/html,application/xhtml+xml,application/xml;q\u003d0.9,image/avif,image/webp,image/apng,/;q\u003d0.8,application/signed-exchange;v\u003db3;q\u003d0.7", "sec-fetch-site": "cross-site", "sec-fetch-mode": "navigate", "sec-fetch-dest": "document", "accept-encoding": "gzip, deflate, br, zstd", "accept-language": "en-GB,en;q\u003d0.9,en-US;q\u003d0.8,de;q\u003d0.7", "cookie": "JSESSIONID\u003d68A8301AB4862BB7D9ECEFA93BCE360D", "x-ssl-cipher": "ECDHE-RSA-AES128-GCM-SHA256", "x-ssl-protocol": "TLSv1.2", "x-forwarded-proto": "https", "x-forwarded-port": "443", "x-forwarded-host": "www.certification.openid.net", "x-forwarded-server": "www.certification.openid.net", "connection": "close" }
http_method	GET
url_fragment	{}
post_body

Verify authorization endpoint response

2026-07-18 15:02:43	SUCCESS	CheckMatchingCallbackParameters Callback parameters successfully verified

2026-07-18 15:02:43	OAuth2-iss-2	ValidateIssIfPresentInAuthorizationResponse No 'iss' value in authorization response.

2026-07-18 15:02:43	SUCCESS	CheckIfAuthorizationEndpointError No error from authorization endpoint

2026-07-18 15:02:43

(1) More

SUCCESS

CheckStateInAuthorizationResponse

State in response correctly returned

state

5YGL3v8rLt

2026-07-18 15:02:43

(1) More

SUCCESS

ExtractAuthorizationCodeFromAuthorizationResponse

Found authorization code

code	Hhu3BvEkgWTYPPv5XCoxtbKALhq04zXgDR-vcAEsQ78

2026-07-18 15:02:43

(3) More

SUCCESS

CreateTokenEndpointRequestForAuthorizationCodeGrant

Created token endpoint request

grant_type	authorization_code
code	Hhu3BvEkgWTYPPv5XCoxtbKALhq04zXgDR-vcAEsQ78
redirect_uri	https://www.certification.openid.net/test/a/codeb/callback

2026-07-18 15:02:43

(1) More

SUCCESS

AddBasicAuthClientSecretToRequest

Added basic authorization header

Authorization

Basic b2lkZi1jb25mLWJhc2ljOlc2T2FnX1NmRjhUOUNLanlRbEJ6M2ZTeVJDUE42MGJwYTZ2TDQ0NTZ5cm8=

2026-07-18 15:02:43

(4) More

CallTokenEndpointAndReturnFullResponse

HTTP request

request_uri	https://phone.codeb.io/oauth2/v1/token
request_method	POST
request_headers	{ "Accept": "application/json", "Authorization": "Basic b2lkZi1jb25mLWJhc2ljOlc2T2FnX1NmRjhUOUNLanlRbEJ6M2ZTeVJDUE42MGJwYTZ2TDQ0NTZ5cm8\u003d", "Content-Type": "application/x-www-form-urlencoded", "Content-Length": "164" }
request_body	grant_type=authorization_code&code=Hhu3BvEkgWTYPPv5XCoxtbKALhq04zXgDR-vcAEsQ78&redirect_uri=https%3A%2F%2Fwww.certification.openid.net%2Ftest%2Fa%2Fcodeb%2Fcallback

2026-07-18 15:02:44

(4) More

RESPONSE

CallTokenEndpointAndReturnFullResponse

HTTP response

response_status_code	200 OK
response_status_text	OK
response_headers	{ "cache-control": "private, no-store,no-store, no-cache, must-revalidate, max-age\u003d0", "pragma": "no-cache", "content-type": "application/json; charset\u003dutf-8", "expires": "0", "x-aspnet-version": "4.0.30319", "referrer-policy": "no-referrer", "x-content-type-options": "nosniff", "permissions-policy": "camera\u003d(self), microphone\u003d(self), display-capture\u003d(self)", "strict-transport-security": "max-age\u003d63072000; includeSubDomains", "date": "Sat, 18 Jul 2026 15:02:43 GMT", "content-length": "1555" }
response_body	{"access_token":"eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6ImVlM2RhZTNmZmI4NzQwMzQifQ.eyJpc3MiOiJodHRwczovL3Bob25lLmNvZGViLmlvIiwic3ViIjoiY2xhdWRlIiwiYXVkIjoib2lkZi1jb25mLWJhc2ljIiwiZXhwIjoxNzg0MzkwNTY0LCJpYXQiOjE3ODQzODY5NjQsInNjb3BlIjoib3BlbmlkIiwicm9sZSI6ImFkbWluIiwiZ3JvdXBzIjpbImFkbWluIl0sImFtciI6WyJwd2QiXSwiYWNyIjoidXJuOmNvZGViOmFjcjpwd2QiLCJ0eXAiOiJhY2Nlc3MiLCJqdGkiOiJnSmlmZjNNZmdFNXIzUEZJR3NaY1dBIn0.PZDwF9tkS486E8JA3Bb9xa7BHm_xH4BR6ObY6QaJ46hmxnZjmj0hqvDSqvp02eQoAcIncHu3v6d4vyeWxB2z4UfgjKF6FZtgo-lW4yAcuPqiguq0wWCiGDTMAM9dUI2YRMBzZ4osf9cU3exvC8fgQNu21EN1z25-oiwKa389GXmY6m97ppkVgZ3M1bWzmJiOzt0nxRvLFp1N7kdfi-EBCHSpcMSW4LVuznG71my-johpCFKii9MltKM4nqENmuyvGKqf_VE4A2IqSPJ87IyZSS3MpySyR-s0eOzl1FoVuXGPHBekFJYGbjgIo0ARRcZ0xhuXawWBshECcXtm5KBoGQ","token_type":"Bearer","expires_in":3600,"id_token":"eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6ImVlM2RhZTNmZmI4NzQwMzQifQ.eyJpc3MiOiJodHRwczovL3Bob25lLmNvZGViLmlvIiwic3ViIjoiY2xhdWRlIiwiYXVkIjoib2lkZi1jb25mLWJhc2ljIiwiZXhwIjoxNzg0MzkwNTY0LCJpYXQiOjE3ODQzODY5NjQsImF1dGhfdGltZSI6MTc4NDM4NTc1NSwibm9uY2UiOiI0V0hvb0w0b1VXIiwiYW1yIjpbInB3ZCJdLCJhY3IiOiJ1cm46Y29kZWI6YWNyOnB3ZCJ9.WFfraFfjb71x7okDxjviJ4JtwJZlqqt7mpeFaO8pi4IeokWQvXmgjeJvkBVqSKl9fvqjiaSX8U8M1MEVXa1XsaAyOAAwu-LvRMrAkS8nDqpZhN2opr5xfJemnSQtlUagqSPzI0HNRUraonXbzRxZYHx_6PvtVIF9CGXFs5gH8oV1o0XGk0zqTWwXP_pRH22eN_uxWMHLv-DK3X0O3iBSU5OumbIbNKDqriCzYDbdy3Q9XMvNpV3QEcaNrLHWx_6dRgQX-m0qP33MSzCQqQxPzq1tX0xWsUAopjVtap2eUAtkfKTsExXcjAYigVnasWm-mC0SzkSkJObcyAMgRWJcQQ","refresh_token":"85iM2TOefkC2bSHZwkNN56QojXd5HyUK5Io-7HAOvos","scope":"openid"}

2026-07-18 15:02:44

(5) More

SUCCESS

CallTokenEndpointAndReturnFullResponse

Parsed token endpoint response

status	200
endpoint_name	https://phone.codeb.io/oauth2/v1/token
headers	{ "cache-control": "private, no-store,no-store, no-cache, must-revalidate, max-age\u003d0", "pragma": "no-cache", "content-type": "application/json; charset\u003dutf-8", "expires": "0", "x-aspnet-version": "4.0.30319", "referrer-policy": "no-referrer", "x-content-type-options": "nosniff", "permissions-policy": "camera\u003d(self), microphone\u003d(self), display-capture\u003d(self)", "strict-transport-security": "max-age\u003d63072000; includeSubDomains", "date": "Sat, 18 Jul 2026 15:02:43 GMT", "content-length": "1555" }
body	{"access_token":"eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6ImVlM2RhZTNmZmI4NzQwMzQifQ.eyJpc3MiOiJodHRwczovL3Bob25lLmNvZGViLmlvIiwic3ViIjoiY2xhdWRlIiwiYXVkIjoib2lkZi1jb25mLWJhc2ljIiwiZXhwIjoxNzg0MzkwNTY0LCJpYXQiOjE3ODQzODY5NjQsInNjb3BlIjoib3BlbmlkIiwicm9sZSI6ImFkbWluIiwiZ3JvdXBzIjpbImFkbWluIl0sImFtciI6WyJwd2QiXSwiYWNyIjoidXJuOmNvZGViOmFjcjpwd2QiLCJ0eXAiOiJhY2Nlc3MiLCJqdGkiOiJnSmlmZjNNZmdFNXIzUEZJR3NaY1dBIn0.PZDwF9tkS486E8JA3Bb9xa7BHm_xH4BR6ObY6QaJ46hmxnZjmj0hqvDSqvp02eQoAcIncHu3v6d4vyeWxB2z4UfgjKF6FZtgo-lW4yAcuPqiguq0wWCiGDTMAM9dUI2YRMBzZ4osf9cU3exvC8fgQNu21EN1z25-oiwKa389GXmY6m97ppkVgZ3M1bWzmJiOzt0nxRvLFp1N7kdfi-EBCHSpcMSW4LVuznG71my-johpCFKii9MltKM4nqENmuyvGKqf_VE4A2IqSPJ87IyZSS3MpySyR-s0eOzl1FoVuXGPHBekFJYGbjgIo0ARRcZ0xhuXawWBshECcXtm5KBoGQ","token_type":"Bearer","expires_in":3600,"id_token":"eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6ImVlM2RhZTNmZmI4NzQwMzQifQ.eyJpc3MiOiJodHRwczovL3Bob25lLmNvZGViLmlvIiwic3ViIjoiY2xhdWRlIiwiYXVkIjoib2lkZi1jb25mLWJhc2ljIiwiZXhwIjoxNzg0MzkwNTY0LCJpYXQiOjE3ODQzODY5NjQsImF1dGhfdGltZSI6MTc4NDM4NTc1NSwibm9uY2UiOiI0V0hvb0w0b1VXIiwiYW1yIjpbInB3ZCJdLCJhY3IiOiJ1cm46Y29kZWI6YWNyOnB3ZCJ9.WFfraFfjb71x7okDxjviJ4JtwJZlqqt7mpeFaO8pi4IeokWQvXmgjeJvkBVqSKl9fvqjiaSX8U8M1MEVXa1XsaAyOAAwu-LvRMrAkS8nDqpZhN2opr5xfJemnSQtlUagqSPzI0HNRUraonXbzRxZYHx_6PvtVIF9CGXFs5gH8oV1o0XGk0zqTWwXP_pRH22eN_uxWMHLv-DK3X0O3iBSU5OumbIbNKDqriCzYDbdy3Q9XMvNpV3QEcaNrLHWx_6dRgQX-m0qP33MSzCQqQxPzq1tX0xWsUAopjVtap2eUAtkfKTsExXcjAYigVnasWm-mC0SzkSkJObcyAMgRWJcQQ","refresh_token":"85iM2TOefkC2bSHZwkNN56QojXd5HyUK5Io-7HAOvos","scope":"openid"}
body_json	{ "access_token": "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6ImVlM2RhZTNmZmI4NzQwMzQifQ.eyJpc3MiOiJodHRwczovL3Bob25lLmNvZGViLmlvIiwic3ViIjoiY2xhdWRlIiwiYXVkIjoib2lkZi1jb25mLWJhc2ljIiwiZXhwIjoxNzg0MzkwNTY0LCJpYXQiOjE3ODQzODY5NjQsInNjb3BlIjoib3BlbmlkIiwicm9sZSI6ImFkbWluIiwiZ3JvdXBzIjpbImFkbWluIl0sImFtciI6WyJwd2QiXSwiYWNyIjoidXJuOmNvZGViOmFjcjpwd2QiLCJ0eXAiOiJhY2Nlc3MiLCJqdGkiOiJnSmlmZjNNZmdFNXIzUEZJR3NaY1dBIn0.PZDwF9tkS486E8JA3Bb9xa7BHm_xH4BR6ObY6QaJ46hmxnZjmj0hqvDSqvp02eQoAcIncHu3v6d4vyeWxB2z4UfgjKF6FZtgo-lW4yAcuPqiguq0wWCiGDTMAM9dUI2YRMBzZ4osf9cU3exvC8fgQNu21EN1z25-oiwKa389GXmY6m97ppkVgZ3M1bWzmJiOzt0nxRvLFp1N7kdfi-EBCHSpcMSW4LVuznG71my-johpCFKii9MltKM4nqENmuyvGKqf_VE4A2IqSPJ87IyZSS3MpySyR-s0eOzl1FoVuXGPHBekFJYGbjgIo0ARRcZ0xhuXawWBshECcXtm5KBoGQ", "token_type": "Bearer", "expires_in": 3600, "id_token": "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6ImVlM2RhZTNmZmI4NzQwMzQifQ.eyJpc3MiOiJodHRwczovL3Bob25lLmNvZGViLmlvIiwic3ViIjoiY2xhdWRlIiwiYXVkIjoib2lkZi1jb25mLWJhc2ljIiwiZXhwIjoxNzg0MzkwNTY0LCJpYXQiOjE3ODQzODY5NjQsImF1dGhfdGltZSI6MTc4NDM4NTc1NSwibm9uY2UiOiI0V0hvb0w0b1VXIiwiYW1yIjpbInB3ZCJdLCJhY3IiOiJ1cm46Y29kZWI6YWNyOnB3ZCJ9.WFfraFfjb71x7okDxjviJ4JtwJZlqqt7mpeFaO8pi4IeokWQvXmgjeJvkBVqSKl9fvqjiaSX8U8M1MEVXa1XsaAyOAAwu-LvRMrAkS8nDqpZhN2opr5xfJemnSQtlUagqSPzI0HNRUraonXbzRxZYHx_6PvtVIF9CGXFs5gH8oV1o0XGk0zqTWwXP_pRH22eN_uxWMHLv-DK3X0O3iBSU5OumbIbNKDqriCzYDbdy3Q9XMvNpV3QEcaNrLHWx_6dRgQX-m0qP33MSzCQqQxPzq1tX0xWsUAopjVtap2eUAtkfKTsExXcjAYigVnasWm-mC0SzkSkJObcyAMgRWJcQQ", "refresh_token": "85iM2TOefkC2bSHZwkNN56QojXd5HyUK5Io-7HAOvos", "scope": "openid" }

2026-07-18 15:02:44	SUCCESS	CheckTokenEndpointHttpStatus200 Token endpoint http status code was 200

2026-07-18 15:02:44	SUCCESS	CheckIfTokenEndpointResponseError No error from token endpoint

2026-07-18 15:02:44

(1) More

SUCCESS

CheckForAccessTokenValue

Found an access token

access_token

eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6ImVlM2RhZTNmZmI4NzQwMzQifQ.eyJpc3MiOiJodHRwczovL3Bob25lLmNvZGViLmlvIiwic3ViIjoiY2xhdWRlIiwiYXVkIjoib2lkZi1jb25mLWJhc2ljIiwiZXhwIjoxNzg0MzkwNTY0LCJpYXQiOjE3ODQzODY5NjQsInNjb3BlIjoib3BlbmlkIiwicm9sZSI6ImFkbWluIiwiZ3JvdXBzIjpbImFkbWluIl0sImFtciI6WyJwd2QiXSwiYWNyIjoidXJuOmNvZGViOmFjcjpwd2QiLCJ0eXAiOiJhY2Nlc3MiLCJqdGkiOiJnSmlmZjNNZmdFNXIzUEZJR3NaY1dBIn0.PZDwF9tkS486E8JA3Bb9xa7BHm_xH4BR6ObY6QaJ46hmxnZjmj0hqvDSqvp02eQoAcIncHu3v6d4vyeWxB2z4UfgjKF6FZtgo-lW4yAcuPqiguq0wWCiGDTMAM9dUI2YRMBzZ4osf9cU3exvC8fgQNu21EN1z25-oiwKa389GXmY6m97ppkVgZ3M1bWzmJiOzt0nxRvLFp1N7kdfi-EBCHSpcMSW4LVuznG71my-johpCFKii9MltKM4nqENmuyvGKqf_VE4A2IqSPJ87IyZSS3MpySyR-s0eOzl1FoVuXGPHBekFJYGbjgIo0ARRcZ0xhuXawWBshECcXtm5KBoGQ

2026-07-18 15:02:44

(2) More

SUCCESS

ExtractAccessTokenFromTokenResponse

Extracted the access token

value

eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6ImVlM2RhZTNmZmI4NzQwMzQifQ.eyJpc3MiOiJodHRwczovL3Bob25lLmNvZGViLmlvIiwic3ViIjoiY2xhdWRlIiwiYXVkIjoib2lkZi1jb25mLWJhc2ljIiwiZXhwIjoxNzg0MzkwNTY0LCJpYXQiOjE3ODQzODY5NjQsInNjb3BlIjoib3BlbmlkIiwicm9sZSI6ImFkbWluIiwiZ3JvdXBzIjpbImFkbWluIl0sImFtciI6WyJwd2QiXSwiYWNyIjoidXJuOmNvZGViOmFjcjpwd2QiLCJ0eXAiOiJhY2Nlc3MiLCJqdGkiOiJnSmlmZjNNZmdFNXIzUEZJR3NaY1dBIn0.PZDwF9tkS486E8JA3Bb9xa7BHm_xH4BR6ObY6QaJ46hmxnZjmj0hqvDSqvp02eQoAcIncHu3v6d4vyeWxB2z4UfgjKF6FZtgo-lW4yAcuPqiguq0wWCiGDTMAM9dUI2YRMBzZ4osf9cU3exvC8fgQNu21EN1z25-oiwKa389GXmY6m97ppkVgZ3M1bWzmJiOzt0nxRvLFp1N7kdfi-EBCHSpcMSW4LVuznG71my-johpCFKii9MltKM4nqENmuyvGKqf_VE4A2IqSPJ87IyZSS3MpySyR-s0eOzl1FoVuXGPHBekFJYGbjgIo0ARRcZ0xhuXawWBshECcXtm5KBoGQ

type

Bearer

2026-07-18 15:02:44

(1) More

SUCCESS

RFC6749-5.1

ExtractExpiresInFromTokenEndpointResponse

Extracted 'expires_in'

expires_in

2026-07-18 15:02:44

(1) More

SUCCESS

RFC6749-5.1

ValidateExpiresIn

expires_in passed all validation checks

expires_in

2026-07-18 15:02:44

(1) More

SUCCESS

CheckForRefreshTokenValue

Found a refresh token

refresh_token

85iM2TOefkC2bSHZwkNN56QojXd5HyUK5Io-7HAOvos

2026-07-18 15:02:44

(2) More

INFO

OIDCC-10.2

ValidateIdTokenFromTokenResponseEncryption

Skipped evaluation due to missing required object: client_jwks

mapped
expected	client_jwks

2026-07-18 15:02:44

(3) More

SUCCESS

OIDCC-3.3.3.3 OIDCC-3.1.3.3

ExtractIdTokenFromTokenResponse

Found and parsed the id_token from token_endpoint_response

value	eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6ImVlM2RhZTNmZmI4NzQwMzQifQ.eyJpc3MiOiJodHRwczovL3Bob25lLmNvZGViLmlvIiwic3ViIjoiY2xhdWRlIiwiYXVkIjoib2lkZi1jb25mLWJhc2ljIiwiZXhwIjoxNzg0MzkwNTY0LCJpYXQiOjE3ODQzODY5NjQsImF1dGhfdGltZSI6MTc4NDM4NTc1NSwibm9uY2UiOiI0V0hvb0w0b1VXIiwiYW1yIjpbInB3ZCJdLCJhY3IiOiJ1cm46Y29kZWI6YWNyOnB3ZCJ9.WFfraFfjb71x7okDxjviJ4JtwJZlqqt7mpeFaO8pi4IeokWQvXmgjeJvkBVqSKl9fvqjiaSX8U8M1MEVXa1XsaAyOAAwu-LvRMrAkS8nDqpZhN2opr5xfJemnSQtlUagqSPzI0HNRUraonXbzRxZYHx_6PvtVIF9CGXFs5gH8oV1o0XGk0zqTWwXP_pRH22eN_uxWMHLv-DK3X0O3iBSU5OumbIbNKDqriCzYDbdy3Q9XMvNpV3QEcaNrLHWx_6dRgQX-m0qP33MSzCQqQxPzq1tX0xWsUAopjVtap2eUAtkfKTsExXcjAYigVnasWm-mC0SzkSkJObcyAMgRWJcQQ
header	{ "kid": "ee3dae3ffb874034", "typ": "JWT", "alg": "RS256" }
claims	{ "sub": "claude", "aud": "oidf-conf-basic", "acr": "urn:codeb:acr:pwd", "auth_time": 1784385755, "amr": [ "pwd" ], "iss": "https://phone.codeb.io", "exp": 1784390564, "iat": 1784386964, "nonce": "4WHooL4oUW" }

2026-07-18 15:02:44	SUCCESS OIDCC-3.1.3.7	ValidateIdToken ID token iss, aud, exp, iat, auth_time, acr & nbf claims passed validation checks

2026-07-18 15:02:44	OIDCC-5.1	ValidateIdTokenStandardClaims sub is a string with content

2026-07-18 15:02:44	SUCCESS OIDCC-5.1	ValidateIdTokenStandardClaims id_token claims are valid

2026-07-18 15:02:44

(1) More

SUCCESS

OIDCC-2

ValidateIdTokenNonce

Nonce values match

nonce

4WHooL4oUW

2026-07-18 15:02:44	SUCCESS OIDCC-5.5.1.1	ValidateIdTokenACRClaimAgainstRequest Nothing to check; the conformance suite did not request an acr claim in request object

2026-07-18 15:02:44

(1) More

SUCCESS

ValidateIdTokenSignature

id_token signature validated

id_token

eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6ImVlM2RhZTNmZmI4NzQwMzQifQ.eyJpc3MiOiJodHRwczovL3Bob25lLmNvZGViLmlvIiwic3ViIjoiY2xhdWRlIiwiYXVkIjoib2lkZi1jb25mLWJhc2ljIiwiZXhwIjoxNzg0MzkwNTY0LCJpYXQiOjE3ODQzODY5NjQsImF1dGhfdGltZSI6MTc4NDM4NTc1NSwibm9uY2UiOiI0V0hvb0w0b1VXIiwiYW1yIjpbInB3ZCJdLCJhY3IiOiJ1cm46Y29kZWI6YWNyOnB3ZCJ9.WFfraFfjb71x7okDxjviJ4JtwJZlqqt7mpeFaO8pi4IeokWQvXmgjeJvkBVqSKl9fvqjiaSX8U8M1MEVXa1XsaAyOAAwu-LvRMrAkS8nDqpZhN2opr5xfJemnSQtlUagqSPzI0HNRUraonXbzRxZYHx_6PvtVIF9CGXFs5gH8oV1o0XGk0zqTWwXP_pRH22eN_uxWMHLv-DK3X0O3iBSU5OumbIbNKDqriCzYDbdy3Q9XMvNpV3QEcaNrLHWx_6dRgQX-m0qP33MSzCQqQxPzq1tX0xWsUAopjVtap2eUAtkfKTsExXcjAYigVnasWm-mC0SzkSkJObcyAMgRWJcQQ

2026-07-18 15:02:44

(1) More

SUCCESS

OIDCC-2

CheckForSubjectInIdToken

Found 'sub' in id_token

sub

claude

2026-07-18 15:02:44	OIDCC-5.1	EnsureIdTokenUpdatedAtValid id_token response does not contain 'updated_at'

2026-07-18 15:02:44

(3) More

INFO

OIDCC-10.2 OIDCC-10.2.1

ValidateEncryptedIdTokenHasKid

Skipped evaluation due to missing required element: id_token jwe_header

path	jwe_header
mapped
object	id_token

2026-07-18 15:02:44

(1) More

SUCCESS

ExtractRefreshTokenFromTokenResponse

Extracted refresh token from response

refresh_token

85iM2TOefkC2bSHZwkNN56QojXd5HyUK5Io-7HAOvos

2026-07-18 15:02:44

(1) More

SUCCESS

OIDCD-3

EnsureServerConfigurationSupportsRefreshToken

The server configuration indicates support for refresh tokens

supported_grant_types

[
  "authorization_code",
  "refresh_token",
  "urn:ietf:params:oauth:grant-type:jwt-bearer"
]

2026-07-18 15:02:44	SUCCESS RFC6749-A.17	EnsureRefreshTokenContainsAllowedCharactersOnly Refresh token does not contain any illegal characters

Refresh Token Request

2026-07-18 15:02:44

(2) More

SUCCESS

CreateRefreshTokenRequest

Created token endpoint request parameters

grant_type	refresh_token
refresh_token	85iM2TOefkC2bSHZwkNN56QojXd5HyUK5Io-7HAOvos

2026-07-18 15:02:44

(3) More

SUCCESS

RFC6749-6

AddScopeToTokenEndpointRequest

Added scope of 'openid' to token endpoint request

grant_type	refresh_token
refresh_token	85iM2TOefkC2bSHZwkNN56QojXd5HyUK5Io-7HAOvos
scope	openid

2026-07-18 15:02:44

(1) More

SUCCESS

AddBasicAuthClientSecretToRequest

Added basic authorization header

Authorization

Basic b2lkZi1jb25mLWJhc2ljOlc2T2FnX1NmRjhUOUNLanlRbEJ6M2ZTeVJDUE42MGJwYTZ2TDQ0NTZ5cm8=

2026-07-18 15:02:44	SUCCESS	WaitForOneSecond Pausing for 1 seconds

2026-07-18 15:02:45	SUCCESS	WaitForOneSecond Woke up after 1 seconds sleep

2026-07-18 15:02:45

(4) More

CallTokenEndpointAndReturnFullResponse

HTTP request

request_uri	https://phone.codeb.io/oauth2/v1/token
request_method	POST
request_headers	{ "Accept": "application/json", "Authorization": "Basic b2lkZi1jb25mLWJhc2ljOlc2T2FnX1NmRjhUOUNLanlRbEJ6M2ZTeVJDUE42MGJwYTZ2TDQ0NTZ5cm8\u003d", "Content-Type": "application/x-www-form-urlencoded", "Content-Length": "95" }
request_body	grant_type=refresh_token&refresh_token=85iM2TOefkC2bSHZwkNN56QojXd5HyUK5Io-7HAOvos&scope=openid

2026-07-18 15:02:45

(4) More

RESPONSE

CallTokenEndpointAndReturnFullResponse

HTTP response

response_status_code	200 OK
response_status_text	OK
response_headers	{ "cache-control": "private, no-store,no-store, no-cache, must-revalidate, max-age\u003d0", "pragma": "no-cache", "content-type": "application/json; charset\u003dutf-8", "expires": "0", "x-aspnet-version": "4.0.30319", "referrer-policy": "no-referrer", "x-content-type-options": "nosniff", "permissions-policy": "camera\u003d(self), microphone\u003d(self), display-capture\u003d(self)", "strict-transport-security": "max-age\u003d63072000; includeSubDomains", "date": "Sat, 18 Jul 2026 15:02:45 GMT", "content-length": "1527" }
response_body	{"access_token":"eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6ImVlM2RhZTNmZmI4NzQwMzQifQ.eyJpc3MiOiJodHRwczovL3Bob25lLmNvZGViLmlvIiwic3ViIjoiY2xhdWRlIiwiYXVkIjoib2lkZi1jb25mLWJhc2ljIiwiZXhwIjoxNzg0MzkwNTY1LCJpYXQiOjE3ODQzODY5NjUsInNjb3BlIjoib3BlbmlkIiwicm9sZSI6ImFkbWluIiwiZ3JvdXBzIjpbImFkbWluIl0sImFtciI6WyJwd2QiXSwiYWNyIjoidXJuOmNvZGViOmFjcjpwd2QiLCJ0eXAiOiJhY2Nlc3MiLCJqdGkiOiJQR2hDcTRoTDFhTjZJQmFYTFJPbDJBIn0.gz5ksk7Hth5sYfC6CZAQW6ueX07ZspEtUJcPQOtPErjXW_cnEIrnzsSpWu77DbV3BYDZoEmSkLw1ii-s37uZq1t8RNokPfBEYIo9f-t_wqYtwZoz-qlOX6t3xACrYlDkHFD-BZIUEckNCZtSyKcpNVoOQ-dAGXsxHSiIA3-jdK1r5tVupseQ9CGol4r0RgJBztSoQ8mzwGgm7W5xbVMJRwhiOAL5fG2hTQyq1IlwBRf7OcLGR-HB3DbbHy3DnawYeWg3G1AT4pk47cb4FM9vzm4wSUnAA7MuC3LnuyYChXatdsMX0NrEuH1qmlOpu4onT0gxroaO4mXO_iFw951aPQ","token_type":"Bearer","expires_in":3600,"id_token":"eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6ImVlM2RhZTNmZmI4NzQwMzQifQ.eyJpc3MiOiJodHRwczovL3Bob25lLmNvZGViLmlvIiwic3ViIjoiY2xhdWRlIiwiYXVkIjoib2lkZi1jb25mLWJhc2ljIiwiZXhwIjoxNzg0MzkwNTY1LCJpYXQiOjE3ODQzODY5NjUsImF1dGhfdGltZSI6MTc4NDM4NTc1NSwiYW1yIjpbInB3ZCJdLCJhY3IiOiJ1cm46Y29kZWI6YWNyOnB3ZCJ9.Ldh9AsM5Y8pkTMmEaMCaWMUY-Va3cl6bmDuvhdBbQp553GXReEXmEAUwf-DCdziZeEf6kK99GrjAotfn6kOWQfCUDpyM7s1MOh9YmiPB5jZ3uPH_ady_6PDX4wO0brgv_C0L7Iirk2YJ2J0ovOp4YPuL1QvgeKgRrE2R-fk4knX-4BKLNZVTioxZHvsm1uJlkS_R_gty7v0BTK8uJkFhoHNPAd2vquPx1tfwwW4gcY263RtjAZM4OgXwjiMV9Ck7e_18sFAqyKnOhTtRnrrk7P2cb_UXWJ8qIqQfY9T-loXCYI77X6ObiFEgS6tPkWWGk37tE-bXR1RWaphB3t9CMg","refresh_token":"7Q4wPZnGbTyHloEnYgcXOwEHfbyMx0L5LJsYQyJrKHo","scope":"openid"}

2026-07-18 15:02:45

(5) More

SUCCESS

CallTokenEndpointAndReturnFullResponse

Parsed token endpoint response

status	200
endpoint_name	https://phone.codeb.io/oauth2/v1/token
headers	{ "cache-control": "private, no-store,no-store, no-cache, must-revalidate, max-age\u003d0", "pragma": "no-cache", "content-type": "application/json; charset\u003dutf-8", "expires": "0", "x-aspnet-version": "4.0.30319", "referrer-policy": "no-referrer", "x-content-type-options": "nosniff", "permissions-policy": "camera\u003d(self), microphone\u003d(self), display-capture\u003d(self)", "strict-transport-security": "max-age\u003d63072000; includeSubDomains", "date": "Sat, 18 Jul 2026 15:02:45 GMT", "content-length": "1527" }
body	{"access_token":"eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6ImVlM2RhZTNmZmI4NzQwMzQifQ.eyJpc3MiOiJodHRwczovL3Bob25lLmNvZGViLmlvIiwic3ViIjoiY2xhdWRlIiwiYXVkIjoib2lkZi1jb25mLWJhc2ljIiwiZXhwIjoxNzg0MzkwNTY1LCJpYXQiOjE3ODQzODY5NjUsInNjb3BlIjoib3BlbmlkIiwicm9sZSI6ImFkbWluIiwiZ3JvdXBzIjpbImFkbWluIl0sImFtciI6WyJwd2QiXSwiYWNyIjoidXJuOmNvZGViOmFjcjpwd2QiLCJ0eXAiOiJhY2Nlc3MiLCJqdGkiOiJQR2hDcTRoTDFhTjZJQmFYTFJPbDJBIn0.gz5ksk7Hth5sYfC6CZAQW6ueX07ZspEtUJcPQOtPErjXW_cnEIrnzsSpWu77DbV3BYDZoEmSkLw1ii-s37uZq1t8RNokPfBEYIo9f-t_wqYtwZoz-qlOX6t3xACrYlDkHFD-BZIUEckNCZtSyKcpNVoOQ-dAGXsxHSiIA3-jdK1r5tVupseQ9CGol4r0RgJBztSoQ8mzwGgm7W5xbVMJRwhiOAL5fG2hTQyq1IlwBRf7OcLGR-HB3DbbHy3DnawYeWg3G1AT4pk47cb4FM9vzm4wSUnAA7MuC3LnuyYChXatdsMX0NrEuH1qmlOpu4onT0gxroaO4mXO_iFw951aPQ","token_type":"Bearer","expires_in":3600,"id_token":"eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6ImVlM2RhZTNmZmI4NzQwMzQifQ.eyJpc3MiOiJodHRwczovL3Bob25lLmNvZGViLmlvIiwic3ViIjoiY2xhdWRlIiwiYXVkIjoib2lkZi1jb25mLWJhc2ljIiwiZXhwIjoxNzg0MzkwNTY1LCJpYXQiOjE3ODQzODY5NjUsImF1dGhfdGltZSI6MTc4NDM4NTc1NSwiYW1yIjpbInB3ZCJdLCJhY3IiOiJ1cm46Y29kZWI6YWNyOnB3ZCJ9.Ldh9AsM5Y8pkTMmEaMCaWMUY-Va3cl6bmDuvhdBbQp553GXReEXmEAUwf-DCdziZeEf6kK99GrjAotfn6kOWQfCUDpyM7s1MOh9YmiPB5jZ3uPH_ady_6PDX4wO0brgv_C0L7Iirk2YJ2J0ovOp4YPuL1QvgeKgRrE2R-fk4knX-4BKLNZVTioxZHvsm1uJlkS_R_gty7v0BTK8uJkFhoHNPAd2vquPx1tfwwW4gcY263RtjAZM4OgXwjiMV9Ck7e_18sFAqyKnOhTtRnrrk7P2cb_UXWJ8qIqQfY9T-loXCYI77X6ObiFEgS6tPkWWGk37tE-bXR1RWaphB3t9CMg","refresh_token":"7Q4wPZnGbTyHloEnYgcXOwEHfbyMx0L5LJsYQyJrKHo","scope":"openid"}
body_json	{ "access_token": "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6ImVlM2RhZTNmZmI4NzQwMzQifQ.eyJpc3MiOiJodHRwczovL3Bob25lLmNvZGViLmlvIiwic3ViIjoiY2xhdWRlIiwiYXVkIjoib2lkZi1jb25mLWJhc2ljIiwiZXhwIjoxNzg0MzkwNTY1LCJpYXQiOjE3ODQzODY5NjUsInNjb3BlIjoib3BlbmlkIiwicm9sZSI6ImFkbWluIiwiZ3JvdXBzIjpbImFkbWluIl0sImFtciI6WyJwd2QiXSwiYWNyIjoidXJuOmNvZGViOmFjcjpwd2QiLCJ0eXAiOiJhY2Nlc3MiLCJqdGkiOiJQR2hDcTRoTDFhTjZJQmFYTFJPbDJBIn0.gz5ksk7Hth5sYfC6CZAQW6ueX07ZspEtUJcPQOtPErjXW_cnEIrnzsSpWu77DbV3BYDZoEmSkLw1ii-s37uZq1t8RNokPfBEYIo9f-t_wqYtwZoz-qlOX6t3xACrYlDkHFD-BZIUEckNCZtSyKcpNVoOQ-dAGXsxHSiIA3-jdK1r5tVupseQ9CGol4r0RgJBztSoQ8mzwGgm7W5xbVMJRwhiOAL5fG2hTQyq1IlwBRf7OcLGR-HB3DbbHy3DnawYeWg3G1AT4pk47cb4FM9vzm4wSUnAA7MuC3LnuyYChXatdsMX0NrEuH1qmlOpu4onT0gxroaO4mXO_iFw951aPQ", "token_type": "Bearer", "expires_in": 3600, "id_token": "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6ImVlM2RhZTNmZmI4NzQwMzQifQ.eyJpc3MiOiJodHRwczovL3Bob25lLmNvZGViLmlvIiwic3ViIjoiY2xhdWRlIiwiYXVkIjoib2lkZi1jb25mLWJhc2ljIiwiZXhwIjoxNzg0MzkwNTY1LCJpYXQiOjE3ODQzODY5NjUsImF1dGhfdGltZSI6MTc4NDM4NTc1NSwiYW1yIjpbInB3ZCJdLCJhY3IiOiJ1cm46Y29kZWI6YWNyOnB3ZCJ9.Ldh9AsM5Y8pkTMmEaMCaWMUY-Va3cl6bmDuvhdBbQp553GXReEXmEAUwf-DCdziZeEf6kK99GrjAotfn6kOWQfCUDpyM7s1MOh9YmiPB5jZ3uPH_ady_6PDX4wO0brgv_C0L7Iirk2YJ2J0ovOp4YPuL1QvgeKgRrE2R-fk4knX-4BKLNZVTioxZHvsm1uJlkS_R_gty7v0BTK8uJkFhoHNPAd2vquPx1tfwwW4gcY263RtjAZM4OgXwjiMV9Ck7e_18sFAqyKnOhTtRnrrk7P2cb_UXWJ8qIqQfY9T-loXCYI77X6ObiFEgS6tPkWWGk37tE-bXR1RWaphB3t9CMg", "refresh_token": "7Q4wPZnGbTyHloEnYgcXOwEHfbyMx0L5LJsYQyJrKHo", "scope": "openid" }

2026-07-18 15:02:45	SUCCESS RFC6749-5.1	CheckTokenEndpointHttpStatus200 Token endpoint http status code was 200

2026-07-18 15:02:45	SUCCESS RFC6749-5.1	CheckTokenEndpointReturnedJsonContentType token_endpoint_response_headers Content-Type: header is application/json

2026-07-18 15:02:45

(1) More

SUCCESS

RFC6749-5.1

CheckTokenEndpointCacheHeaders

'cache-control' header in token endpoint response contains expected value.

cache_control_header

private, no-store,no-store, no-cache, must-revalidate, max-age=0

2026-07-18 15:02:45	SUCCESS	CheckIfTokenEndpointResponseError No error from token endpoint

2026-07-18 15:02:45

(2) More

SUCCESS

ExtractAccessTokenFromTokenResponse

Extracted the access token

value

eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6ImVlM2RhZTNmZmI4NzQwMzQifQ.eyJpc3MiOiJodHRwczovL3Bob25lLmNvZGViLmlvIiwic3ViIjoiY2xhdWRlIiwiYXVkIjoib2lkZi1jb25mLWJhc2ljIiwiZXhwIjoxNzg0MzkwNTY1LCJpYXQiOjE3ODQzODY5NjUsInNjb3BlIjoib3BlbmlkIiwicm9sZSI6ImFkbWluIiwiZ3JvdXBzIjpbImFkbWluIl0sImFtciI6WyJwd2QiXSwiYWNyIjoidXJuOmNvZGViOmFjcjpwd2QiLCJ0eXAiOiJhY2Nlc3MiLCJqdGkiOiJQR2hDcTRoTDFhTjZJQmFYTFJPbDJBIn0.gz5ksk7Hth5sYfC6CZAQW6ueX07ZspEtUJcPQOtPErjXW_cnEIrnzsSpWu77DbV3BYDZoEmSkLw1ii-s37uZq1t8RNokPfBEYIo9f-t_wqYtwZoz-qlOX6t3xACrYlDkHFD-BZIUEckNCZtSyKcpNVoOQ-dAGXsxHSiIA3-jdK1r5tVupseQ9CGol4r0RgJBztSoQ8mzwGgm7W5xbVMJRwhiOAL5fG2hTQyq1IlwBRf7OcLGR-HB3DbbHy3DnawYeWg3G1AT4pk47cb4FM9vzm4wSUnAA7MuC3LnuyYChXatdsMX0NrEuH1qmlOpu4onT0gxroaO4mXO_iFw951aPQ

type

Bearer

2026-07-18 15:02:45	SUCCESS FAPI-R-6.2.2-1 FAPI1-BASE-6.2.2-1	CheckTokenTypeIsBearer Token type is bearer

2026-07-18 15:02:45

(3) More

SUCCESS

FAPI-R-5.2.2-16 FAPI1-BASE-5.2.2-16

EnsureMinimumAccessTokenEntropy

Calculated shannon entropy seems sufficient

actual	4285.249632851724
expected	96.0
value	eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6ImVlM2RhZTNmZmI4NzQwMzQifQ.eyJpc3MiOiJodHRwczovL3Bob25lLmNvZGViLmlvIiwic3ViIjoiY2xhdWRlIiwiYXVkIjoib2lkZi1jb25mLWJhc2ljIiwiZXhwIjoxNzg0MzkwNTY1LCJpYXQiOjE3ODQzODY5NjUsInNjb3BlIjoib3BlbmlkIiwicm9sZSI6ImFkbWluIiwiZ3JvdXBzIjpbImFkbWluIl0sImFtciI6WyJwd2QiXSwiYWNyIjoidXJuOmNvZGViOmFjcjpwd2QiLCJ0eXAiOiJhY2Nlc3MiLCJqdGkiOiJQR2hDcTRoTDFhTjZJQmFYTFJPbDJBIn0.gz5ksk7Hth5sYfC6CZAQW6ueX07ZspEtUJcPQOtPErjXW_cnEIrnzsSpWu77DbV3BYDZoEmSkLw1ii-s37uZq1t8RNokPfBEYIo9f-t_wqYtwZoz-qlOX6t3xACrYlDkHFD-BZIUEckNCZtSyKcpNVoOQ-dAGXsxHSiIA3-jdK1r5tVupseQ9CGol4r0RgJBztSoQ8mzwGgm7W5xbVMJRwhiOAL5fG2hTQyq1IlwBRf7OcLGR-HB3DbbHy3DnawYeWg3G1AT4pk47cb4FM9vzm4wSUnAA7MuC3LnuyYChXatdsMX0NrEuH1qmlOpu4onT0gxroaO4mXO_iFw951aPQ

2026-07-18 15:02:45	SUCCESS RFC6749-A.12	EnsureAccessTokenContainsAllowedCharactersOnly Access token does not contain any illegal characters

2026-07-18 15:02:45

(1) More

SUCCESS

RFC6749-5.1 RFC6749-6

ExtractExpiresInFromTokenEndpointResponse

Extracted 'expires_in'

expires_in

2026-07-18 15:02:45

(1) More

SUCCESS

RFC6749-5.1

ValidateExpiresIn

expires_in passed all validation checks

expires_in

2026-07-18 15:02:45

(2) More

SUCCESS

EnsureAccessTokenValuesAreDifferent

Access token values are not the same

second_access_token

eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6ImVlM2RhZTNmZmI4NzQwMzQifQ.eyJpc3MiOiJodHRwczovL3Bob25lLmNvZGViLmlvIiwic3ViIjoiY2xhdWRlIiwiYXVkIjoib2lkZi1jb25mLWJhc2ljIiwiZXhwIjoxNzg0MzkwNTY1LCJpYXQiOjE3ODQzODY5NjUsInNjb3BlIjoib3BlbmlkIiwicm9sZSI6ImFkbWluIiwiZ3JvdXBzIjpbImFkbWluIl0sImFtciI6WyJwd2QiXSwiYWNyIjoidXJuOmNvZGViOmFjcjpwd2QiLCJ0eXAiOiJhY2Nlc3MiLCJqdGkiOiJQR2hDcTRoTDFhTjZJQmFYTFJPbDJBIn0.gz5ksk7Hth5sYfC6CZAQW6ueX07ZspEtUJcPQOtPErjXW_cnEIrnzsSpWu77DbV3BYDZoEmSkLw1ii-s37uZq1t8RNokPfBEYIo9f-t_wqYtwZoz-qlOX6t3xACrYlDkHFD-BZIUEckNCZtSyKcpNVoOQ-dAGXsxHSiIA3-jdK1r5tVupseQ9CGol4r0RgJBztSoQ8mzwGgm7W5xbVMJRwhiOAL5fG2hTQyq1IlwBRf7OcLGR-HB3DbbHy3DnawYeWg3G1AT4pk47cb4FM9vzm4wSUnAA7MuC3LnuyYChXatdsMX0NrEuH1qmlOpu4onT0gxroaO4mXO_iFw951aPQ

first_access_token

eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6ImVlM2RhZTNmZmI4NzQwMzQifQ.eyJpc3MiOiJodHRwczovL3Bob25lLmNvZGViLmlvIiwic3ViIjoiY2xhdWRlIiwiYXVkIjoib2lkZi1jb25mLWJhc2ljIiwiZXhwIjoxNzg0MzkwNTY0LCJpYXQiOjE3ODQzODY5NjQsInNjb3BlIjoib3BlbmlkIiwicm9sZSI6ImFkbWluIiwiZ3JvdXBzIjpbImFkbWluIl0sImFtciI6WyJwd2QiXSwiYWNyIjoidXJuOmNvZGViOmFjcjpwd2QiLCJ0eXAiOiJhY2Nlc3MiLCJqdGkiOiJnSmlmZjNNZmdFNXIzUEZJR3NaY1dBIn0.PZDwF9tkS486E8JA3Bb9xa7BHm_xH4BR6ObY6QaJ46hmxnZjmj0hqvDSqvp02eQoAcIncHu3v6d4vyeWxB2z4UfgjKF6FZtgo-lW4yAcuPqiguq0wWCiGDTMAM9dUI2YRMBzZ4osf9cU3exvC8fgQNu21EN1z25-oiwKa389GXmY6m97ppkVgZ3M1bWzmJiOzt0nxRvLFp1N7kdfi-EBCHSpcMSW4LVuznG71my-johpCFKii9MltKM4nqENmuyvGKqf_VE4A2IqSPJ87IyZSS3MpySyR-s0eOzl1FoVuXGPHBekFJYGbjgIo0ARRcZ0xhuXawWBshECcXtm5KBoGQ

2026-07-18 15:02:45

(2) More

INFO

ValidateIdTokenFromTokenResponseEncryption

Skipped evaluation due to missing required object: client_jwks

mapped
expected	client_jwks

2026-07-18 15:02:45

(3) More

SUCCESS

ExtractIdTokenFromTokenResponse

Found and parsed the id_token from token_endpoint_response

value	eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6ImVlM2RhZTNmZmI4NzQwMzQifQ.eyJpc3MiOiJodHRwczovL3Bob25lLmNvZGViLmlvIiwic3ViIjoiY2xhdWRlIiwiYXVkIjoib2lkZi1jb25mLWJhc2ljIiwiZXhwIjoxNzg0MzkwNTY1LCJpYXQiOjE3ODQzODY5NjUsImF1dGhfdGltZSI6MTc4NDM4NTc1NSwiYW1yIjpbInB3ZCJdLCJhY3IiOiJ1cm46Y29kZWI6YWNyOnB3ZCJ9.Ldh9AsM5Y8pkTMmEaMCaWMUY-Va3cl6bmDuvhdBbQp553GXReEXmEAUwf-DCdziZeEf6kK99GrjAotfn6kOWQfCUDpyM7s1MOh9YmiPB5jZ3uPH_ady_6PDX4wO0brgv_C0L7Iirk2YJ2J0ovOp4YPuL1QvgeKgRrE2R-fk4knX-4BKLNZVTioxZHvsm1uJlkS_R_gty7v0BTK8uJkFhoHNPAd2vquPx1tfwwW4gcY263RtjAZM4OgXwjiMV9Ck7e_18sFAqyKnOhTtRnrrk7P2cb_UXWJ8qIqQfY9T-loXCYI77X6ObiFEgS6tPkWWGk37tE-bXR1RWaphB3t9CMg
header	{ "kid": "ee3dae3ffb874034", "typ": "JWT", "alg": "RS256" }
claims	{ "sub": "claude", "aud": "oidf-conf-basic", "acr": "urn:codeb:acr:pwd", "auth_time": 1784385755, "amr": [ "pwd" ], "iss": "https://phone.codeb.io", "exp": 1784390565, "iat": 1784386965 }

2026-07-18 15:02:45

(1) More

SUCCESS

ExtractRefreshTokenFromTokenResponse

Extracted refresh token from response

refresh_token

7Q4wPZnGbTyHloEnYgcXOwEHfbyMx0L5LJsYQyJrKHo

2026-07-18 15:02:45

(2) More

SUCCESS

RFC6749-10.10

EnsureMinimumRefreshTokenLength

Refresh token is of sufficient length

actual	344
required	128

2026-07-18 15:02:45

(3) More

SUCCESS

RFC6749-10.10

EnsureMinimumRefreshTokenEntropy

Calculated shannon entropy seems sufficient

actual	205.81960944786323
expected	96.0
value	7Q4wPZnGbTyHloEnYgcXOwEHfbyMx0L5LJsYQyJrKHo

2026-07-18 15:02:45

(6) More

SUCCESS

OIDCC-12.2

CompareIdTokenClaims

Validated id token claims successfully

iss	{ "first": "https://phone.codeb.io", "second": "https://phone.codeb.io", "note": "Values are expected to be equal" }
sub	{ "first": "claude", "second": "claude", "note": "Values are expected to be equal" }
iat	{ "first": 1784386964, "second": 1784386965, "note": "Values are expected to be different" }
aud	{ "first": "oidf-conf-basic", "second": "oidf-conf-basic", "note": "Values are expected to be equal" }
auth_time	{ "first": 1784385755, "second": 1784385755, "note": "Values are expected to be equal" }
azp	Id tokens do not contain azp claims

Userinfo endpoint tests

2026-07-18 15:02:45

(4) More

CallProtectedResource

HTTP request

request_uri	https://phone.codeb.io/oauth2/v1/userinfo
request_method	GET
request_headers	{ "Accept": "application/json", "Authorization": "Bearer eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6ImVlM2RhZTNmZmI4NzQwMzQifQ.eyJpc3MiOiJodHRwczovL3Bob25lLmNvZGViLmlvIiwic3ViIjoiY2xhdWRlIiwiYXVkIjoib2lkZi1jb25mLWJhc2ljIiwiZXhwIjoxNzg0MzkwNTY1LCJpYXQiOjE3ODQzODY5NjUsInNjb3BlIjoib3BlbmlkIiwicm9sZSI6ImFkbWluIiwiZ3JvdXBzIjpbImFkbWluIl0sImFtciI6WyJwd2QiXSwiYWNyIjoidXJuOmNvZGViOmFjcjpwd2QiLCJ0eXAiOiJhY2Nlc3MiLCJqdGkiOiJQR2hDcTRoTDFhTjZJQmFYTFJPbDJBIn0.gz5ksk7Hth5sYfC6CZAQW6ueX07ZspEtUJcPQOtPErjXW_cnEIrnzsSpWu77DbV3BYDZoEmSkLw1ii-s37uZq1t8RNokPfBEYIo9f-t_wqYtwZoz-qlOX6t3xACrYlDkHFD-BZIUEckNCZtSyKcpNVoOQ-dAGXsxHSiIA3-jdK1r5tVupseQ9CGol4r0RgJBztSoQ8mzwGgm7W5xbVMJRwhiOAL5fG2hTQyq1IlwBRf7OcLGR-HB3DbbHy3DnawYeWg3G1AT4pk47cb4FM9vzm4wSUnAA7MuC3LnuyYChXatdsMX0NrEuH1qmlOpu4onT0gxroaO4mXO_iFw951aPQ", "Content-Length": "0" }
request_body

2026-07-18 15:02:46

(4) More

RESPONSE

CallProtectedResource

HTTP response

response_status_code	200 OK
response_status_text	OK
response_headers	{ "cache-control": "private, no-store,no-store, no-cache, must-revalidate, max-age\u003d0", "pragma": "no-cache,no-cache", "content-type": "application/json; charset\u003dutf-8", "expires": "0", "x-aspnet-version": "4.0.30319", "referrer-policy": "no-referrer", "x-content-type-options": "nosniff", "permissions-policy": "camera\u003d(self), microphone\u003d(self), display-capture\u003d(self)", "strict-transport-security": "max-age\u003d63072000; includeSubDomains", "date": "Sat, 18 Jul 2026 15:02:45 GMT", "content-length": "46" }
response_body	{"sub":"claude","preferred_username":"claude"}

2026-07-18 15:02:46

(4) More

SUCCESS

CallProtectedResource

Got a response from the resource endpoint

status	200
endpoint_name	resource
headers	{ "cache-control": "private, no-store,no-store, no-cache, must-revalidate, max-age\u003d0", "pragma": "no-cache,no-cache", "content-type": "application/json; charset\u003dutf-8", "expires": "0", "x-aspnet-version": "4.0.30319", "referrer-policy": "no-referrer", "x-content-type-options": "nosniff", "permissions-policy": "camera\u003d(self), microphone\u003d(self), display-capture\u003d(self)", "strict-transport-security": "max-age\u003d63072000; includeSubDomains", "date": "Sat, 18 Jul 2026 15:02:45 GMT", "content-length": "46" }
body	{"sub":"claude","preferred_username":"claude"}

2026-07-18 15:02:46

(2) More

SUCCESS

EnsureHttpStatusCodeIs200

resource endpoint returned the expected http status

http_status	200
expected_status	200

Second client: Make request to authorization endpoint

2026-07-18 15:02:46

(3) More

SUCCESS

CreateAuthorizationEndpointRequestFromClientInformation

Created authorization endpoint request

client_id	client_secret_basic
redirect_uri	https://www.certification.openid.net/test/a/codeb/callback
scope	openid

2026-07-18 15:02:46

(2) More

CreateRandomStateValue

Created state value

state	qHHLNifcfE
requested_state_length	10

2026-07-18 15:02:46

(4) More

SUCCESS

AddStateToAuthorizationEndpointRequest

Added state parameter to request

client_id	client_secret_basic
redirect_uri	https://www.certification.openid.net/test/a/codeb/callback
scope	openid
state	qHHLNifcfE

2026-07-18 15:02:46

(2) More

CreateRandomNonceValue

Created nonce value

requested_nonce_length	43
nonce	QE0xxD8Z9lD6lXm1bKCqCLpyOYTVTpUprE8Yd6U-._~

2026-07-18 15:02:46

(5) More

SUCCESS

AddNonceToAuthorizationEndpointRequest

Added nonce parameter to request

client_id	client_secret_basic
redirect_uri	https://www.certification.openid.net/test/a/codeb/callback
scope	openid
state	qHHLNifcfE
nonce	QE0xxD8Z9lD6lXm1bKCqCLpyOYTVTpUprE8Yd6U-._~

2026-07-18 15:02:46

(6) More

SUCCESS

SetAuthorizationEndpointRequestResponseTypeFromEnvironment

Added response_type parameter to request

client_id	client_secret_basic
redirect_uri	https://www.certification.openid.net/test/a/codeb/callback
scope	openid
state	qHHLNifcfE
nonce	QE0xxD8Z9lD6lXm1bKCqCLpyOYTVTpUprE8Yd6U-._~
response_type	code

2026-07-18 15:02:46	SUCCESS OIDCC-11	AddPromptConsentToAuthorizationEndpointRequestIfScopeContainsOfflineAccess Not adding prompt=consent as the scope in the configuration does not contain offline_access

2026-07-18 15:02:46

(2) More

SUCCESS

BuildPlainRedirectToAuthorizationEndpoint

Sending to authorization endpoint

auth_request

{
  "client_id": "client_secret_basic",
  "redirect_uri": "https://www.certification.openid.net/test/a/codeb/callback",
  "scope": "openid",
  "state": "qHHLNifcfE",
  "nonce": "QE0xxD8Z9lD6lXm1bKCqCLpyOYTVTpUprE8Yd6U-._~",
  "response_type": "code"
}

redirect_to_authorization_endpoint

https://phone.codeb.io/oauth2/v1/authorize?client_id=client_secret_basic&nonce=QE0xxD8Z9lD6lXm1bKCqCLpyOYTVTpUprE8Yd6U-._~&redirect_uri=https://www.certification.openid.net/test/a/codeb/callback&response_type=code&scope=openid&state=qHHLNifcfE

2026-07-18 15:02:46

(2) More

REDIRECT

oidcc-refresh-token

Redirecting to authorization endpoint

method

GET

redirect_to

https://phone.codeb.io/oauth2/v1/authorize?client_id=client_secret_basic&nonce=QE0xxD8Z9lD6lXm1bKCqCLpyOYTVTpUprE8Yd6U-._~&redirect_uri=https://www.certification.openid.net/test/a/codeb/callback&response_type=code&scope=openid&state=qHHLNifcfE

2026-07-18 15:02:50

(12) More

INCOMING

oidcc-refresh-token

Incoming HTTP request to /test/a/codeb/callback

incoming_headers	{ "host": "www.certification.openid.net", "sec-ch-ua": "\"Google Chrome\";v\u003d\"149\", \"Chromium\";v\u003d\"149\", \"Not)A;Brand\";v\u003d\"24\"", "sec-ch-ua-mobile": "?0", "sec-ch-ua-platform": "\"Windows\"", "upgrade-insecure-requests": "1", "user-agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36", "accept": "text/html,application/xhtml+xml,application/xml;q\u003d0.9,image/avif,image/webp,image/apng,/;q\u003d0.8,application/signed-exchange;v\u003db3;q\u003d0.7", "sec-fetch-site": "cross-site", "sec-fetch-mode": "navigate", "sec-fetch-dest": "document", "accept-encoding": "gzip, deflate, br, zstd", "accept-language": "en-GB,en;q\u003d0.9,en-US;q\u003d0.8,de;q\u003d0.7", "cookie": "JSESSIONID\u003d68A8301AB4862BB7D9ECEFA93BCE360D", "connection": "close" }
incoming_path	/test/a/codeb/callback
incoming_body_form_params
incoming_method	GET
incoming_tls_version	TLSv1.2
incoming_tls_cert
incoming_query_string_params	{ "code": "4qzmYAUB_1zOUCDdxZdi5-NCK-hAmy7QCjDZElHCHGc", "state": "qHHLNifcfE" }
incoming_body
incoming_tls_chain	[ "CONFORMANCE_SUITE_JSON_NULL", "CONFORMANCE_SUITE_JSON_NULL", "CONFORMANCE_SUITE_JSON_NULL", "CONFORMANCE_SUITE_JSON_NULL", "CONFORMANCE_SUITE_JSON_NULL", "CONFORMANCE_SUITE_JSON_NULL" ]
incoming_body_json_parse_error
incoming_tls_cipher	ECDHE-RSA-AES128-GCM-SHA256
incoming_body_json

2026-07-18 15:02:50

(1) More

SUCCESS

CreateRandomImplicitSubmitUrl

Created random implicit submission URL

implicit_submit

{
  "path": "implicit/g2FlLmPbkp5ljDexwOAr",
  "fullUrl": "https://www.certification.openid.net/test/a/codeb/implicit/g2FlLmPbkp5ljDexwOAr"
}

2026-07-18 15:02:50

(2) More

OUTGOING

oidcc-refresh-token

Response to HTTP request to test instance 9wCcblk5hXQgK4w

outgoing

ModelAndView [view="implicitCallback"; model={implicitSubmitUrl=https://www.certification.openid.net/test/a/codeb/implicit/g2FlLmPbkp5ljDexwOAr, returnUrl=/log-detail.html?log=9wCcblk5hXQgK4w}]

outgoing_path

callback

2026-07-18 15:02:50

(12) More

INCOMING

oidcc-refresh-token

Incoming HTTP request to /test/a/codeb/implicit/g2FlLmPbkp5ljDexwOAr

incoming_headers	{ "host": "www.certification.openid.net", "sec-ch-ua-platform": "\"Windows\"", "user-agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36", "sec-ch-ua": "\"Google Chrome\";v\u003d\"149\", \"Chromium\";v\u003d\"149\", \"Not)A;Brand\";v\u003d\"24\"", "content-type": "text/plain", "sec-ch-ua-mobile": "?0", "accept": "/", "origin": "https://www.certification.openid.net", "sec-fetch-site": "same-origin", "sec-fetch-mode": "cors", "sec-fetch-dest": "empty", "referer": "https://www.certification.openid.net/test/a/codeb/callback?code\u003d4qzmYAUB_1zOUCDdxZdi5-NCK-hAmy7QCjDZElHCHGc\u0026state\u003dqHHLNifcfE", "accept-encoding": "gzip, deflate, br, zstd", "accept-language": "en-GB,en;q\u003d0.9,en-US;q\u003d0.8,de;q\u003d0.7", "cookie": "JSESSIONID\u003d68A8301AB4862BB7D9ECEFA93BCE360D", "content-length": "0", "connection": "close" }
incoming_path	/test/a/codeb/implicit/g2FlLmPbkp5ljDexwOAr
incoming_body_form_params
incoming_method	POST
incoming_tls_version	TLSv1.2
incoming_tls_cert
incoming_query_string_params	{}
incoming_body
incoming_tls_chain	[ "CONFORMANCE_SUITE_JSON_NULL", "CONFORMANCE_SUITE_JSON_NULL", "CONFORMANCE_SUITE_JSON_NULL", "CONFORMANCE_SUITE_JSON_NULL", "CONFORMANCE_SUITE_JSON_NULL", "CONFORMANCE_SUITE_JSON_NULL" ]
incoming_body_json_parse_error
incoming_tls_cipher	ECDHE-RSA-AES128-GCM-SHA256
incoming_body_json

2026-07-18 15:02:50

(4) More

OUTGOING

oidcc-refresh-token

Response to HTTP request to test instance 9wCcblk5hXQgK4w

outgoing_status_code	204
outgoing_body
outgoing_headers	{}
outgoing_path	implicit/g2FlLmPbkp5ljDexwOAr

2026-07-18 15:02:50	SUCCESS	ExtractImplicitHashToCallbackResponse implicit_hash is empty

2026-07-18 15:02:50

(5) More

REDIRECT-IN

oidcc-refresh-token

Authorization endpoint response captured

url_query	{ "code": "4qzmYAUB_1zOUCDdxZdi5-NCK-hAmy7QCjDZElHCHGc", "state": "qHHLNifcfE" }
headers	{ "host": "www.certification.openid.net", "sec-ch-ua": "\"Google Chrome\";v\u003d\"149\", \"Chromium\";v\u003d\"149\", \"Not)A;Brand\";v\u003d\"24\"", "sec-ch-ua-mobile": "?0", "sec-ch-ua-platform": "\"Windows\"", "upgrade-insecure-requests": "1", "user-agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36", "accept": "text/html,application/xhtml+xml,application/xml;q\u003d0.9,image/avif,image/webp,image/apng,/;q\u003d0.8,application/signed-exchange;v\u003db3;q\u003d0.7", "sec-fetch-site": "cross-site", "sec-fetch-mode": "navigate", "sec-fetch-dest": "document", "accept-encoding": "gzip, deflate, br, zstd", "accept-language": "en-GB,en;q\u003d0.9,en-US;q\u003d0.8,de;q\u003d0.7", "cookie": "JSESSIONID\u003d68A8301AB4862BB7D9ECEFA93BCE360D", "x-ssl-cipher": "ECDHE-RSA-AES128-GCM-SHA256", "x-ssl-protocol": "TLSv1.2", "x-forwarded-proto": "https", "x-forwarded-port": "443", "x-forwarded-host": "www.certification.openid.net", "x-forwarded-server": "www.certification.openid.net", "connection": "close" }
http_method	GET
url_fragment	{}
post_body

Second client: Verify authorization endpoint response

2026-07-18 15:02:50	SUCCESS	CheckMatchingCallbackParameters Callback parameters successfully verified

2026-07-18 15:02:50	OAuth2-iss-2	ValidateIssIfPresentInAuthorizationResponse No 'iss' value in authorization response.

2026-07-18 15:02:50	SUCCESS	CheckIfAuthorizationEndpointError No error from authorization endpoint

2026-07-18 15:02:50

(1) More

SUCCESS

CheckStateInAuthorizationResponse

State in response correctly returned

state

qHHLNifcfE

2026-07-18 15:02:50

(1) More

SUCCESS

ExtractAuthorizationCodeFromAuthorizationResponse

Found authorization code

code	4qzmYAUB_1zOUCDdxZdi5-NCK-hAmy7QCjDZElHCHGc

2026-07-18 15:02:50

(3) More

SUCCESS

CreateTokenEndpointRequestForAuthorizationCodeGrant

Created token endpoint request

grant_type	authorization_code
code	4qzmYAUB_1zOUCDdxZdi5-NCK-hAmy7QCjDZElHCHGc
redirect_uri	https://www.certification.openid.net/test/a/codeb/callback

2026-07-18 15:02:50

(1) More

SUCCESS

AddBasicAuthClientSecretToRequest

Added basic authorization header

Authorization

Basic Y2xpZW50X3NlY3JldF9iYXNpYzpGZEwtMHFTQzhvVlZ5OVZoMUV0MlR4N293cGR1a1M2NDNpLU5XYXlzUXZZ

2026-07-18 15:02:50

(4) More

CallTokenEndpointAndReturnFullResponse

HTTP request

request_uri	https://phone.codeb.io/oauth2/v1/token
request_method	POST
request_headers	{ "Accept": "application/json", "Authorization": "Basic Y2xpZW50X3NlY3JldF9iYXNpYzpGZEwtMHFTQzhvVlZ5OVZoMUV0MlR4N293cGR1a1M2NDNpLU5XYXlzUXZZ", "Content-Type": "application/x-www-form-urlencoded", "Content-Length": "164" }
request_body	grant_type=authorization_code&code=4qzmYAUB_1zOUCDdxZdi5-NCK-hAmy7QCjDZElHCHGc&redirect_uri=https%3A%2F%2Fwww.certification.openid.net%2Ftest%2Fa%2Fcodeb%2Fcallback

2026-07-18 15:02:51

(4) More

RESPONSE

CallTokenEndpointAndReturnFullResponse

HTTP response

response_status_code	200 OK
response_status_text	OK
response_headers	{ "cache-control": "private, no-store,no-store, no-cache, must-revalidate, max-age\u003d0", "pragma": "no-cache", "content-type": "application/json; charset\u003dutf-8", "expires": "0", "x-aspnet-version": "4.0.30319", "referrer-policy": "no-referrer", "x-content-type-options": "nosniff", "permissions-policy": "camera\u003d(self), microphone\u003d(self), display-capture\u003d(self)", "strict-transport-security": "max-age\u003d63072000; includeSubDomains", "date": "Sat, 18 Jul 2026 15:02:50 GMT", "content-length": "1610" }
response_body	{"access_token":"eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6ImVlM2RhZTNmZmI4NzQwMzQifQ.eyJpc3MiOiJodHRwczovL3Bob25lLmNvZGViLmlvIiwic3ViIjoiY2xhdWRlIiwiYXVkIjoiY2xpZW50X3NlY3JldF9iYXNpYyIsImV4cCI6MTc4NDM5MDU3MSwiaWF0IjoxNzg0Mzg2OTcxLCJzY29wZSI6Im9wZW5pZCIsInJvbGUiOiJhZG1pbiIsImdyb3VwcyI6WyJhZG1pbiJdLCJhbXIiOlsicHdkIl0sImFjciI6InVybjpjb2RlYjphY3I6cHdkIiwidHlwIjoiYWNjZXNzIiwianRpIjoiLU5CQWtJVkFFLVVMcE9FWk1LcUp3ZyJ9.yX-01GjFExmvV5vDTVwhjWk3Bcv9n9bi72hhZEkh6rnZnIbMh8ZAJp7jaYXJd3g2SxFqsedf9oKxWWqZ_xfafOYbzPf6QS6_QOKbOkgv9lR401xmNEgOA4I3YLQxKAcLen1llRHxLfsr4cjw6dkOkCHhFfjdn5KkAHZx7Dvj3Ft9CzhYGYx-YWuSInzeb-_CmotWBnPfC1yX-qtxUKE1H4MjIlKAgPf1JXQN66IxisRfsdqOHcR46zMG1xUGV96JpmCHvHouELsLWObk3gEfUCogfS0WOJD6F34425UBkktHFut15zTbkd-fqLnqX5IWpfOHT38O2rx4hHdAFGXffw","token_type":"Bearer","expires_in":3600,"id_token":"eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6ImVlM2RhZTNmZmI4NzQwMzQifQ.eyJpc3MiOiJodHRwczovL3Bob25lLmNvZGViLmlvIiwic3ViIjoiY2xhdWRlIiwiYXVkIjoiY2xpZW50X3NlY3JldF9iYXNpYyIsImV4cCI6MTc4NDM5MDU3MSwiaWF0IjoxNzg0Mzg2OTcxLCJhdXRoX3RpbWUiOjE3ODQzODU3NTUsIm5vbmNlIjoiUUUweHhEOFo5bEQ2bFhtMWJLQ3FDTHB5T1lUVlRwVXByRThZZDZVLS5ffiIsImFtciI6WyJwd2QiXSwiYWNyIjoidXJuOmNvZGViOmFjcjpwd2QifQ.RtOcvLy_Q9cIhUE3CfgD1HA06Huh_MB4LqH_zPmEKu1o8BbK4wnz4WkxSxK4I58d__1aJcY2nZxp2U4JAapllHkAYwyhzeQutchHBJco4RQlpbaL20PC_qJNNmt07UaqKKq7KGoo9HJ9h_fZNElccUNdj1NLLdoiLEWCFGunzCWa2d7-l7yPlA0VYXRnV-W9fMyTDzkdVi3AFskzS5Ze3-yctD6dGiUXCx2SWBn4JGWVIQCGdLcHXEqaormUlU7Ppgf0XznfnbDDiKJiLEMQsvd5JlMJYuXYZ9R1JT-ynHgcg0PLUq4iOvQDrKxJUw12fuzUOK-EGe27SB3xASKW4g","refresh_token":"z0_vGJ0jwnbXU4ogBZfJgDer8CsgkR-rkLCFGLR-7DY","scope":"openid"}

2026-07-18 15:02:51

(5) More

SUCCESS

CallTokenEndpointAndReturnFullResponse

Parsed token endpoint response

status	200
endpoint_name	https://phone.codeb.io/oauth2/v1/token
headers	{ "cache-control": "private, no-store,no-store, no-cache, must-revalidate, max-age\u003d0", "pragma": "no-cache", "content-type": "application/json; charset\u003dutf-8", "expires": "0", "x-aspnet-version": "4.0.30319", "referrer-policy": "no-referrer", "x-content-type-options": "nosniff", "permissions-policy": "camera\u003d(self), microphone\u003d(self), display-capture\u003d(self)", "strict-transport-security": "max-age\u003d63072000; includeSubDomains", "date": "Sat, 18 Jul 2026 15:02:50 GMT", "content-length": "1610" }
body	{"access_token":"eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6ImVlM2RhZTNmZmI4NzQwMzQifQ.eyJpc3MiOiJodHRwczovL3Bob25lLmNvZGViLmlvIiwic3ViIjoiY2xhdWRlIiwiYXVkIjoiY2xpZW50X3NlY3JldF9iYXNpYyIsImV4cCI6MTc4NDM5MDU3MSwiaWF0IjoxNzg0Mzg2OTcxLCJzY29wZSI6Im9wZW5pZCIsInJvbGUiOiJhZG1pbiIsImdyb3VwcyI6WyJhZG1pbiJdLCJhbXIiOlsicHdkIl0sImFjciI6InVybjpjb2RlYjphY3I6cHdkIiwidHlwIjoiYWNjZXNzIiwianRpIjoiLU5CQWtJVkFFLVVMcE9FWk1LcUp3ZyJ9.yX-01GjFExmvV5vDTVwhjWk3Bcv9n9bi72hhZEkh6rnZnIbMh8ZAJp7jaYXJd3g2SxFqsedf9oKxWWqZ_xfafOYbzPf6QS6_QOKbOkgv9lR401xmNEgOA4I3YLQxKAcLen1llRHxLfsr4cjw6dkOkCHhFfjdn5KkAHZx7Dvj3Ft9CzhYGYx-YWuSInzeb-_CmotWBnPfC1yX-qtxUKE1H4MjIlKAgPf1JXQN66IxisRfsdqOHcR46zMG1xUGV96JpmCHvHouELsLWObk3gEfUCogfS0WOJD6F34425UBkktHFut15zTbkd-fqLnqX5IWpfOHT38O2rx4hHdAFGXffw","token_type":"Bearer","expires_in":3600,"id_token":"eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6ImVlM2RhZTNmZmI4NzQwMzQifQ.eyJpc3MiOiJodHRwczovL3Bob25lLmNvZGViLmlvIiwic3ViIjoiY2xhdWRlIiwiYXVkIjoiY2xpZW50X3NlY3JldF9iYXNpYyIsImV4cCI6MTc4NDM5MDU3MSwiaWF0IjoxNzg0Mzg2OTcxLCJhdXRoX3RpbWUiOjE3ODQzODU3NTUsIm5vbmNlIjoiUUUweHhEOFo5bEQ2bFhtMWJLQ3FDTHB5T1lUVlRwVXByRThZZDZVLS5ffiIsImFtciI6WyJwd2QiXSwiYWNyIjoidXJuOmNvZGViOmFjcjpwd2QifQ.RtOcvLy_Q9cIhUE3CfgD1HA06Huh_MB4LqH_zPmEKu1o8BbK4wnz4WkxSxK4I58d__1aJcY2nZxp2U4JAapllHkAYwyhzeQutchHBJco4RQlpbaL20PC_qJNNmt07UaqKKq7KGoo9HJ9h_fZNElccUNdj1NLLdoiLEWCFGunzCWa2d7-l7yPlA0VYXRnV-W9fMyTDzkdVi3AFskzS5Ze3-yctD6dGiUXCx2SWBn4JGWVIQCGdLcHXEqaormUlU7Ppgf0XznfnbDDiKJiLEMQsvd5JlMJYuXYZ9R1JT-ynHgcg0PLUq4iOvQDrKxJUw12fuzUOK-EGe27SB3xASKW4g","refresh_token":"z0_vGJ0jwnbXU4ogBZfJgDer8CsgkR-rkLCFGLR-7DY","scope":"openid"}
body_json	{ "access_token": "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6ImVlM2RhZTNmZmI4NzQwMzQifQ.eyJpc3MiOiJodHRwczovL3Bob25lLmNvZGViLmlvIiwic3ViIjoiY2xhdWRlIiwiYXVkIjoiY2xpZW50X3NlY3JldF9iYXNpYyIsImV4cCI6MTc4NDM5MDU3MSwiaWF0IjoxNzg0Mzg2OTcxLCJzY29wZSI6Im9wZW5pZCIsInJvbGUiOiJhZG1pbiIsImdyb3VwcyI6WyJhZG1pbiJdLCJhbXIiOlsicHdkIl0sImFjciI6InVybjpjb2RlYjphY3I6cHdkIiwidHlwIjoiYWNjZXNzIiwianRpIjoiLU5CQWtJVkFFLVVMcE9FWk1LcUp3ZyJ9.yX-01GjFExmvV5vDTVwhjWk3Bcv9n9bi72hhZEkh6rnZnIbMh8ZAJp7jaYXJd3g2SxFqsedf9oKxWWqZ_xfafOYbzPf6QS6_QOKbOkgv9lR401xmNEgOA4I3YLQxKAcLen1llRHxLfsr4cjw6dkOkCHhFfjdn5KkAHZx7Dvj3Ft9CzhYGYx-YWuSInzeb-_CmotWBnPfC1yX-qtxUKE1H4MjIlKAgPf1JXQN66IxisRfsdqOHcR46zMG1xUGV96JpmCHvHouELsLWObk3gEfUCogfS0WOJD6F34425UBkktHFut15zTbkd-fqLnqX5IWpfOHT38O2rx4hHdAFGXffw", "token_type": "Bearer", "expires_in": 3600, "id_token": "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6ImVlM2RhZTNmZmI4NzQwMzQifQ.eyJpc3MiOiJodHRwczovL3Bob25lLmNvZGViLmlvIiwic3ViIjoiY2xhdWRlIiwiYXVkIjoiY2xpZW50X3NlY3JldF9iYXNpYyIsImV4cCI6MTc4NDM5MDU3MSwiaWF0IjoxNzg0Mzg2OTcxLCJhdXRoX3RpbWUiOjE3ODQzODU3NTUsIm5vbmNlIjoiUUUweHhEOFo5bEQ2bFhtMWJLQ3FDTHB5T1lUVlRwVXByRThZZDZVLS5ffiIsImFtciI6WyJwd2QiXSwiYWNyIjoidXJuOmNvZGViOmFjcjpwd2QifQ.RtOcvLy_Q9cIhUE3CfgD1HA06Huh_MB4LqH_zPmEKu1o8BbK4wnz4WkxSxK4I58d__1aJcY2nZxp2U4JAapllHkAYwyhzeQutchHBJco4RQlpbaL20PC_qJNNmt07UaqKKq7KGoo9HJ9h_fZNElccUNdj1NLLdoiLEWCFGunzCWa2d7-l7yPlA0VYXRnV-W9fMyTDzkdVi3AFskzS5Ze3-yctD6dGiUXCx2SWBn4JGWVIQCGdLcHXEqaormUlU7Ppgf0XznfnbDDiKJiLEMQsvd5JlMJYuXYZ9R1JT-ynHgcg0PLUq4iOvQDrKxJUw12fuzUOK-EGe27SB3xASKW4g", "refresh_token": "z0_vGJ0jwnbXU4ogBZfJgDer8CsgkR-rkLCFGLR-7DY", "scope": "openid" }

2026-07-18 15:02:51	SUCCESS	CheckTokenEndpointHttpStatus200 Token endpoint http status code was 200

2026-07-18 15:02:51	SUCCESS	CheckIfTokenEndpointResponseError No error from token endpoint

2026-07-18 15:02:51

(1) More

SUCCESS

CheckForAccessTokenValue

Found an access token

access_token

eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6ImVlM2RhZTNmZmI4NzQwMzQifQ.eyJpc3MiOiJodHRwczovL3Bob25lLmNvZGViLmlvIiwic3ViIjoiY2xhdWRlIiwiYXVkIjoiY2xpZW50X3NlY3JldF9iYXNpYyIsImV4cCI6MTc4NDM5MDU3MSwiaWF0IjoxNzg0Mzg2OTcxLCJzY29wZSI6Im9wZW5pZCIsInJvbGUiOiJhZG1pbiIsImdyb3VwcyI6WyJhZG1pbiJdLCJhbXIiOlsicHdkIl0sImFjciI6InVybjpjb2RlYjphY3I6cHdkIiwidHlwIjoiYWNjZXNzIiwianRpIjoiLU5CQWtJVkFFLVVMcE9FWk1LcUp3ZyJ9.yX-01GjFExmvV5vDTVwhjWk3Bcv9n9bi72hhZEkh6rnZnIbMh8ZAJp7jaYXJd3g2SxFqsedf9oKxWWqZ_xfafOYbzPf6QS6_QOKbOkgv9lR401xmNEgOA4I3YLQxKAcLen1llRHxLfsr4cjw6dkOkCHhFfjdn5KkAHZx7Dvj3Ft9CzhYGYx-YWuSInzeb-_CmotWBnPfC1yX-qtxUKE1H4MjIlKAgPf1JXQN66IxisRfsdqOHcR46zMG1xUGV96JpmCHvHouELsLWObk3gEfUCogfS0WOJD6F34425UBkktHFut15zTbkd-fqLnqX5IWpfOHT38O2rx4hHdAFGXffw

2026-07-18 15:02:51

(2) More

SUCCESS

ExtractAccessTokenFromTokenResponse

Extracted the access token

value

eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6ImVlM2RhZTNmZmI4NzQwMzQifQ.eyJpc3MiOiJodHRwczovL3Bob25lLmNvZGViLmlvIiwic3ViIjoiY2xhdWRlIiwiYXVkIjoiY2xpZW50X3NlY3JldF9iYXNpYyIsImV4cCI6MTc4NDM5MDU3MSwiaWF0IjoxNzg0Mzg2OTcxLCJzY29wZSI6Im9wZW5pZCIsInJvbGUiOiJhZG1pbiIsImdyb3VwcyI6WyJhZG1pbiJdLCJhbXIiOlsicHdkIl0sImFjciI6InVybjpjb2RlYjphY3I6cHdkIiwidHlwIjoiYWNjZXNzIiwianRpIjoiLU5CQWtJVkFFLVVMcE9FWk1LcUp3ZyJ9.yX-01GjFExmvV5vDTVwhjWk3Bcv9n9bi72hhZEkh6rnZnIbMh8ZAJp7jaYXJd3g2SxFqsedf9oKxWWqZ_xfafOYbzPf6QS6_QOKbOkgv9lR401xmNEgOA4I3YLQxKAcLen1llRHxLfsr4cjw6dkOkCHhFfjdn5KkAHZx7Dvj3Ft9CzhYGYx-YWuSInzeb-_CmotWBnPfC1yX-qtxUKE1H4MjIlKAgPf1JXQN66IxisRfsdqOHcR46zMG1xUGV96JpmCHvHouELsLWObk3gEfUCogfS0WOJD6F34425UBkktHFut15zTbkd-fqLnqX5IWpfOHT38O2rx4hHdAFGXffw

type

Bearer

2026-07-18 15:02:51

(1) More

SUCCESS

RFC6749-5.1

ExtractExpiresInFromTokenEndpointResponse

Extracted 'expires_in'

expires_in

2026-07-18 15:02:51

(1) More

SUCCESS

RFC6749-5.1

ValidateExpiresIn

expires_in passed all validation checks

expires_in

2026-07-18 15:02:51

(1) More

SUCCESS

CheckForRefreshTokenValue

Found a refresh token

refresh_token

z0_vGJ0jwnbXU4ogBZfJgDer8CsgkR-rkLCFGLR-7DY

2026-07-18 15:02:51

(2) More

INFO

OIDCC-10.2

ValidateIdTokenFromTokenResponseEncryption

Skipped evaluation due to missing required object: client_jwks

mapped
expected	client_jwks

2026-07-18 15:02:51

(3) More

SUCCESS

OIDCC-3.3.3.3 OIDCC-3.1.3.3

ExtractIdTokenFromTokenResponse

Found and parsed the id_token from token_endpoint_response

value	eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6ImVlM2RhZTNmZmI4NzQwMzQifQ.eyJpc3MiOiJodHRwczovL3Bob25lLmNvZGViLmlvIiwic3ViIjoiY2xhdWRlIiwiYXVkIjoiY2xpZW50X3NlY3JldF9iYXNpYyIsImV4cCI6MTc4NDM5MDU3MSwiaWF0IjoxNzg0Mzg2OTcxLCJhdXRoX3RpbWUiOjE3ODQzODU3NTUsIm5vbmNlIjoiUUUweHhEOFo5bEQ2bFhtMWJLQ3FDTHB5T1lUVlRwVXByRThZZDZVLS5ffiIsImFtciI6WyJwd2QiXSwiYWNyIjoidXJuOmNvZGViOmFjcjpwd2QifQ.RtOcvLy_Q9cIhUE3CfgD1HA06Huh_MB4LqH_zPmEKu1o8BbK4wnz4WkxSxK4I58d__1aJcY2nZxp2U4JAapllHkAYwyhzeQutchHBJco4RQlpbaL20PC_qJNNmt07UaqKKq7KGoo9HJ9h_fZNElccUNdj1NLLdoiLEWCFGunzCWa2d7-l7yPlA0VYXRnV-W9fMyTDzkdVi3AFskzS5Ze3-yctD6dGiUXCx2SWBn4JGWVIQCGdLcHXEqaormUlU7Ppgf0XznfnbDDiKJiLEMQsvd5JlMJYuXYZ9R1JT-ynHgcg0PLUq4iOvQDrKxJUw12fuzUOK-EGe27SB3xASKW4g
header	{ "kid": "ee3dae3ffb874034", "typ": "JWT", "alg": "RS256" }
claims	{ "sub": "claude", "aud": "client_secret_basic", "acr": "urn:codeb:acr:pwd", "auth_time": 1784385755, "amr": [ "pwd" ], "iss": "https://phone.codeb.io", "exp": 1784390571, "iat": 1784386971, "nonce": "QE0xxD8Z9lD6lXm1bKCqCLpyOYTVTpUprE8Yd6U-._~" }

2026-07-18 15:02:51	SUCCESS OIDCC-3.1.3.7	ValidateIdToken ID token iss, aud, exp, iat, auth_time, acr & nbf claims passed validation checks

2026-07-18 15:02:51	OIDCC-5.1	ValidateIdTokenStandardClaims sub is a string with content

2026-07-18 15:02:51	SUCCESS OIDCC-5.1	ValidateIdTokenStandardClaims id_token claims are valid

2026-07-18 15:02:51

(1) More

SUCCESS

OIDCC-2

ValidateIdTokenNonce

Nonce values match

nonce

QE0xxD8Z9lD6lXm1bKCqCLpyOYTVTpUprE8Yd6U-._~

2026-07-18 15:02:51	SUCCESS OIDCC-5.5.1.1	ValidateIdTokenACRClaimAgainstRequest Nothing to check; the conformance suite did not request an acr claim in request object

2026-07-18 15:02:51

(1) More

SUCCESS

ValidateIdTokenSignature

id_token signature validated

id_token

eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6ImVlM2RhZTNmZmI4NzQwMzQifQ.eyJpc3MiOiJodHRwczovL3Bob25lLmNvZGViLmlvIiwic3ViIjoiY2xhdWRlIiwiYXVkIjoiY2xpZW50X3NlY3JldF9iYXNpYyIsImV4cCI6MTc4NDM5MDU3MSwiaWF0IjoxNzg0Mzg2OTcxLCJhdXRoX3RpbWUiOjE3ODQzODU3NTUsIm5vbmNlIjoiUUUweHhEOFo5bEQ2bFhtMWJLQ3FDTHB5T1lUVlRwVXByRThZZDZVLS5ffiIsImFtciI6WyJwd2QiXSwiYWNyIjoidXJuOmNvZGViOmFjcjpwd2QifQ.RtOcvLy_Q9cIhUE3CfgD1HA06Huh_MB4LqH_zPmEKu1o8BbK4wnz4WkxSxK4I58d__1aJcY2nZxp2U4JAapllHkAYwyhzeQutchHBJco4RQlpbaL20PC_qJNNmt07UaqKKq7KGoo9HJ9h_fZNElccUNdj1NLLdoiLEWCFGunzCWa2d7-l7yPlA0VYXRnV-W9fMyTDzkdVi3AFskzS5Ze3-yctD6dGiUXCx2SWBn4JGWVIQCGdLcHXEqaormUlU7Ppgf0XznfnbDDiKJiLEMQsvd5JlMJYuXYZ9R1JT-ynHgcg0PLUq4iOvQDrKxJUw12fuzUOK-EGe27SB3xASKW4g

2026-07-18 15:02:51

(1) More

SUCCESS

OIDCC-2

CheckForSubjectInIdToken

Found 'sub' in id_token

sub

claude

2026-07-18 15:02:51	OIDCC-5.1	EnsureIdTokenUpdatedAtValid id_token response does not contain 'updated_at'

2026-07-18 15:02:51

(3) More

INFO

OIDCC-10.2 OIDCC-10.2.1

ValidateEncryptedIdTokenHasKid

Skipped evaluation due to missing required element: id_token jwe_header

path	jwe_header
mapped
object	id_token

2026-07-18 15:02:51

(1) More

SUCCESS

ExtractRefreshTokenFromTokenResponse

Extracted refresh token from response

refresh_token

z0_vGJ0jwnbXU4ogBZfJgDer8CsgkR-rkLCFGLR-7DY

2026-07-18 15:02:51

(1) More

SUCCESS

OIDCD-3

EnsureServerConfigurationSupportsRefreshToken

The server configuration indicates support for refresh tokens

supported_grant_types

[
  "authorization_code",
  "refresh_token",
  "urn:ietf:params:oauth:grant-type:jwt-bearer"
]

2026-07-18 15:02:51	SUCCESS RFC6749-A.17	EnsureRefreshTokenContainsAllowedCharactersOnly Refresh token does not contain any illegal characters

Second client: Refresh Token Request

2026-07-18 15:02:51

(2) More

SUCCESS

CreateRefreshTokenRequest

Created token endpoint request parameters

grant_type	refresh_token
refresh_token	z0_vGJ0jwnbXU4ogBZfJgDer8CsgkR-rkLCFGLR-7DY

2026-07-18 15:02:51

(1) More

SUCCESS

AddBasicAuthClientSecretToRequest

Added basic authorization header

Authorization

Basic Y2xpZW50X3NlY3JldF9iYXNpYzpGZEwtMHFTQzhvVlZ5OVZoMUV0MlR4N293cGR1a1M2NDNpLU5XYXlzUXZZ

2026-07-18 15:02:51	SUCCESS	WaitForOneSecond Pausing for 1 seconds

2026-07-18 15:02:52	SUCCESS	WaitForOneSecond Woke up after 1 seconds sleep

2026-07-18 15:02:52

(4) More

CallTokenEndpointAndReturnFullResponse

HTTP request

request_uri	https://phone.codeb.io/oauth2/v1/token
request_method	POST
request_headers	{ "Accept": "application/json", "Authorization": "Basic Y2xpZW50X3NlY3JldF9iYXNpYzpGZEwtMHFTQzhvVlZ5OVZoMUV0MlR4N293cGR1a1M2NDNpLU5XYXlzUXZZ", "Content-Type": "application/x-www-form-urlencoded", "Content-Length": "82" }
request_body	grant_type=refresh_token&refresh_token=z0_vGJ0jwnbXU4ogBZfJgDer8CsgkR-rkLCFGLR-7DY

2026-07-18 15:02:53

(4) More

RESPONSE

CallTokenEndpointAndReturnFullResponse

HTTP response

response_status_code	200 OK
response_status_text	OK
response_headers	{ "cache-control": "private, no-store,no-store, no-cache, must-revalidate, max-age\u003d0", "pragma": "no-cache", "content-type": "application/json; charset\u003dutf-8", "expires": "0", "x-aspnet-version": "4.0.30319", "referrer-policy": "no-referrer", "x-content-type-options": "nosniff", "permissions-policy": "camera\u003d(self), microphone\u003d(self), display-capture\u003d(self)", "strict-transport-security": "max-age\u003d63072000; includeSubDomains", "date": "Sat, 18 Jul 2026 15:02:52 GMT", "content-length": "1538" }
response_body	{"access_token":"eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6ImVlM2RhZTNmZmI4NzQwMzQifQ.eyJpc3MiOiJodHRwczovL3Bob25lLmNvZGViLmlvIiwic3ViIjoiY2xhdWRlIiwiYXVkIjoiY2xpZW50X3NlY3JldF9iYXNpYyIsImV4cCI6MTc4NDM5MDU3MiwiaWF0IjoxNzg0Mzg2OTcyLCJzY29wZSI6Im9wZW5pZCIsInJvbGUiOiJhZG1pbiIsImdyb3VwcyI6WyJhZG1pbiJdLCJhbXIiOlsicHdkIl0sImFjciI6InVybjpjb2RlYjphY3I6cHdkIiwidHlwIjoiYWNjZXNzIiwianRpIjoibDlLaFlpUmpxQlpNR1o1VG1OTjNwdyJ9.g-ONPQ9uU6YpRIR9Pu8GSESL6jSMq5NDf-BS0ppNxcRMCpIhrguwrcI_KP-XpYKoPJ8EP3ZYTwxPjcCppuf888OF88zxUmd9qq-DQOvlYdzt_JqGN7tlsd9FEuOV-JUJOeF_ILrngp0PMNfK2OYkCUfjseOthLMtMELz_LKrwevgkYy4mrLXeJC4cxJZse0LM1UDqonjaiDQZ-ZuyPWykabWwmPKMWFdkxG-tQDG9yuHezKq6JKnnalzpZwNSUhswzoiOJbmonXEAe_GFV0WJCt6HGg2rYeuJRmecEYpk4troCmXjJmCgCpgSUz6yGYEX_zSbKRruY7FwH_mdmJzOA","token_type":"Bearer","expires_in":3600,"id_token":"eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6ImVlM2RhZTNmZmI4NzQwMzQifQ.eyJpc3MiOiJodHRwczovL3Bob25lLmNvZGViLmlvIiwic3ViIjoiY2xhdWRlIiwiYXVkIjoiY2xpZW50X3NlY3JldF9iYXNpYyIsImV4cCI6MTc4NDM5MDU3MiwiaWF0IjoxNzg0Mzg2OTcyLCJhdXRoX3RpbWUiOjE3ODQzODU3NTUsImFtciI6WyJwd2QiXSwiYWNyIjoidXJuOmNvZGViOmFjcjpwd2QifQ.ab_4qegDFWm6pzcfqsJCgRliBle1crM9_pu1_uWt_LMJIJOO_YZtTFXsxmJUHbP_FY6Zx7xKk0t6LNxP_Sd5pmZEZGqR6Kp-pO3QiBfA2pP2Ueo9exNTfijj6BzotZ9xbp3cjTbD8vbQSeQbuP37taz3mB4ijGs1-UJ3j4o6M9hstMt21Wm-Pzyy8aAOKRK1P7Z3sO7pxHfwk9sxNNbML4jM1xM2RsgYm8dfbjYy-na0fG_NbLr7p4UXvCAFjcdq4--_qadfNmNaULupTSuETOmH0xl7_CwtCA51d9pCiIWv-pVUFjE7K-SjWnxL0-zrFp4YA_ZTdP0LurLRVCXaeQ","refresh_token":"cL9pL6OdCdI9LZASV7MXVAxUeGn9RsG_AgPeKjq8MSo","scope":"openid"}

2026-07-18 15:02:53

(5) More

SUCCESS

CallTokenEndpointAndReturnFullResponse

Parsed token endpoint response

status	200
endpoint_name	https://phone.codeb.io/oauth2/v1/token
headers	{ "cache-control": "private, no-store,no-store, no-cache, must-revalidate, max-age\u003d0", "pragma": "no-cache", "content-type": "application/json; charset\u003dutf-8", "expires": "0", "x-aspnet-version": "4.0.30319", "referrer-policy": "no-referrer", "x-content-type-options": "nosniff", "permissions-policy": "camera\u003d(self), microphone\u003d(self), display-capture\u003d(self)", "strict-transport-security": "max-age\u003d63072000; includeSubDomains", "date": "Sat, 18 Jul 2026 15:02:52 GMT", "content-length": "1538" }
body	{"access_token":"eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6ImVlM2RhZTNmZmI4NzQwMzQifQ.eyJpc3MiOiJodHRwczovL3Bob25lLmNvZGViLmlvIiwic3ViIjoiY2xhdWRlIiwiYXVkIjoiY2xpZW50X3NlY3JldF9iYXNpYyIsImV4cCI6MTc4NDM5MDU3MiwiaWF0IjoxNzg0Mzg2OTcyLCJzY29wZSI6Im9wZW5pZCIsInJvbGUiOiJhZG1pbiIsImdyb3VwcyI6WyJhZG1pbiJdLCJhbXIiOlsicHdkIl0sImFjciI6InVybjpjb2RlYjphY3I6cHdkIiwidHlwIjoiYWNjZXNzIiwianRpIjoibDlLaFlpUmpxQlpNR1o1VG1OTjNwdyJ9.g-ONPQ9uU6YpRIR9Pu8GSESL6jSMq5NDf-BS0ppNxcRMCpIhrguwrcI_KP-XpYKoPJ8EP3ZYTwxPjcCppuf888OF88zxUmd9qq-DQOvlYdzt_JqGN7tlsd9FEuOV-JUJOeF_ILrngp0PMNfK2OYkCUfjseOthLMtMELz_LKrwevgkYy4mrLXeJC4cxJZse0LM1UDqonjaiDQZ-ZuyPWykabWwmPKMWFdkxG-tQDG9yuHezKq6JKnnalzpZwNSUhswzoiOJbmonXEAe_GFV0WJCt6HGg2rYeuJRmecEYpk4troCmXjJmCgCpgSUz6yGYEX_zSbKRruY7FwH_mdmJzOA","token_type":"Bearer","expires_in":3600,"id_token":"eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6ImVlM2RhZTNmZmI4NzQwMzQifQ.eyJpc3MiOiJodHRwczovL3Bob25lLmNvZGViLmlvIiwic3ViIjoiY2xhdWRlIiwiYXVkIjoiY2xpZW50X3NlY3JldF9iYXNpYyIsImV4cCI6MTc4NDM5MDU3MiwiaWF0IjoxNzg0Mzg2OTcyLCJhdXRoX3RpbWUiOjE3ODQzODU3NTUsImFtciI6WyJwd2QiXSwiYWNyIjoidXJuOmNvZGViOmFjcjpwd2QifQ.ab_4qegDFWm6pzcfqsJCgRliBle1crM9_pu1_uWt_LMJIJOO_YZtTFXsxmJUHbP_FY6Zx7xKk0t6LNxP_Sd5pmZEZGqR6Kp-pO3QiBfA2pP2Ueo9exNTfijj6BzotZ9xbp3cjTbD8vbQSeQbuP37taz3mB4ijGs1-UJ3j4o6M9hstMt21Wm-Pzyy8aAOKRK1P7Z3sO7pxHfwk9sxNNbML4jM1xM2RsgYm8dfbjYy-na0fG_NbLr7p4UXvCAFjcdq4--_qadfNmNaULupTSuETOmH0xl7_CwtCA51d9pCiIWv-pVUFjE7K-SjWnxL0-zrFp4YA_ZTdP0LurLRVCXaeQ","refresh_token":"cL9pL6OdCdI9LZASV7MXVAxUeGn9RsG_AgPeKjq8MSo","scope":"openid"}
body_json	{ "access_token": "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6ImVlM2RhZTNmZmI4NzQwMzQifQ.eyJpc3MiOiJodHRwczovL3Bob25lLmNvZGViLmlvIiwic3ViIjoiY2xhdWRlIiwiYXVkIjoiY2xpZW50X3NlY3JldF9iYXNpYyIsImV4cCI6MTc4NDM5MDU3MiwiaWF0IjoxNzg0Mzg2OTcyLCJzY29wZSI6Im9wZW5pZCIsInJvbGUiOiJhZG1pbiIsImdyb3VwcyI6WyJhZG1pbiJdLCJhbXIiOlsicHdkIl0sImFjciI6InVybjpjb2RlYjphY3I6cHdkIiwidHlwIjoiYWNjZXNzIiwianRpIjoibDlLaFlpUmpxQlpNR1o1VG1OTjNwdyJ9.g-ONPQ9uU6YpRIR9Pu8GSESL6jSMq5NDf-BS0ppNxcRMCpIhrguwrcI_KP-XpYKoPJ8EP3ZYTwxPjcCppuf888OF88zxUmd9qq-DQOvlYdzt_JqGN7tlsd9FEuOV-JUJOeF_ILrngp0PMNfK2OYkCUfjseOthLMtMELz_LKrwevgkYy4mrLXeJC4cxJZse0LM1UDqonjaiDQZ-ZuyPWykabWwmPKMWFdkxG-tQDG9yuHezKq6JKnnalzpZwNSUhswzoiOJbmonXEAe_GFV0WJCt6HGg2rYeuJRmecEYpk4troCmXjJmCgCpgSUz6yGYEX_zSbKRruY7FwH_mdmJzOA", "token_type": "Bearer", "expires_in": 3600, "id_token": "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6ImVlM2RhZTNmZmI4NzQwMzQifQ.eyJpc3MiOiJodHRwczovL3Bob25lLmNvZGViLmlvIiwic3ViIjoiY2xhdWRlIiwiYXVkIjoiY2xpZW50X3NlY3JldF9iYXNpYyIsImV4cCI6MTc4NDM5MDU3MiwiaWF0IjoxNzg0Mzg2OTcyLCJhdXRoX3RpbWUiOjE3ODQzODU3NTUsImFtciI6WyJwd2QiXSwiYWNyIjoidXJuOmNvZGViOmFjcjpwd2QifQ.ab_4qegDFWm6pzcfqsJCgRliBle1crM9_pu1_uWt_LMJIJOO_YZtTFXsxmJUHbP_FY6Zx7xKk0t6LNxP_Sd5pmZEZGqR6Kp-pO3QiBfA2pP2Ueo9exNTfijj6BzotZ9xbp3cjTbD8vbQSeQbuP37taz3mB4ijGs1-UJ3j4o6M9hstMt21Wm-Pzyy8aAOKRK1P7Z3sO7pxHfwk9sxNNbML4jM1xM2RsgYm8dfbjYy-na0fG_NbLr7p4UXvCAFjcdq4--_qadfNmNaULupTSuETOmH0xl7_CwtCA51d9pCiIWv-pVUFjE7K-SjWnxL0-zrFp4YA_ZTdP0LurLRVCXaeQ", "refresh_token": "cL9pL6OdCdI9LZASV7MXVAxUeGn9RsG_AgPeKjq8MSo", "scope": "openid" }

2026-07-18 15:02:53	SUCCESS RFC6749-5.1	CheckTokenEndpointHttpStatus200 Token endpoint http status code was 200

2026-07-18 15:02:53	SUCCESS RFC6749-5.1	CheckTokenEndpointReturnedJsonContentType token_endpoint_response_headers Content-Type: header is application/json

2026-07-18 15:02:53

(1) More

SUCCESS

RFC6749-5.1

CheckTokenEndpointCacheHeaders

'cache-control' header in token endpoint response contains expected value.

cache_control_header

private, no-store,no-store, no-cache, must-revalidate, max-age=0

2026-07-18 15:02:53	SUCCESS	CheckIfTokenEndpointResponseError No error from token endpoint

2026-07-18 15:02:53

(2) More

SUCCESS

ExtractAccessTokenFromTokenResponse

Extracted the access token

value

eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6ImVlM2RhZTNmZmI4NzQwMzQifQ.eyJpc3MiOiJodHRwczovL3Bob25lLmNvZGViLmlvIiwic3ViIjoiY2xhdWRlIiwiYXVkIjoiY2xpZW50X3NlY3JldF9iYXNpYyIsImV4cCI6MTc4NDM5MDU3MiwiaWF0IjoxNzg0Mzg2OTcyLCJzY29wZSI6Im9wZW5pZCIsInJvbGUiOiJhZG1pbiIsImdyb3VwcyI6WyJhZG1pbiJdLCJhbXIiOlsicHdkIl0sImFjciI6InVybjpjb2RlYjphY3I6cHdkIiwidHlwIjoiYWNjZXNzIiwianRpIjoibDlLaFlpUmpxQlpNR1o1VG1OTjNwdyJ9.g-ONPQ9uU6YpRIR9Pu8GSESL6jSMq5NDf-BS0ppNxcRMCpIhrguwrcI_KP-XpYKoPJ8EP3ZYTwxPjcCppuf888OF88zxUmd9qq-DQOvlYdzt_JqGN7tlsd9FEuOV-JUJOeF_ILrngp0PMNfK2OYkCUfjseOthLMtMELz_LKrwevgkYy4mrLXeJC4cxJZse0LM1UDqonjaiDQZ-ZuyPWykabWwmPKMWFdkxG-tQDG9yuHezKq6JKnnalzpZwNSUhswzoiOJbmonXEAe_GFV0WJCt6HGg2rYeuJRmecEYpk4troCmXjJmCgCpgSUz6yGYEX_zSbKRruY7FwH_mdmJzOA

type

Bearer

2026-07-18 15:02:53	SUCCESS FAPI-R-6.2.2-1 FAPI1-BASE-6.2.2-1	CheckTokenTypeIsBearer Token type is bearer

2026-07-18 15:02:53

(3) More

SUCCESS

FAPI-R-5.2.2-16 FAPI1-BASE-5.2.2-16

EnsureMinimumAccessTokenEntropy

Calculated shannon entropy seems sufficient

actual	4311.315877723917
expected	96.0
value	eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6ImVlM2RhZTNmZmI4NzQwMzQifQ.eyJpc3MiOiJodHRwczovL3Bob25lLmNvZGViLmlvIiwic3ViIjoiY2xhdWRlIiwiYXVkIjoiY2xpZW50X3NlY3JldF9iYXNpYyIsImV4cCI6MTc4NDM5MDU3MiwiaWF0IjoxNzg0Mzg2OTcyLCJzY29wZSI6Im9wZW5pZCIsInJvbGUiOiJhZG1pbiIsImdyb3VwcyI6WyJhZG1pbiJdLCJhbXIiOlsicHdkIl0sImFjciI6InVybjpjb2RlYjphY3I6cHdkIiwidHlwIjoiYWNjZXNzIiwianRpIjoibDlLaFlpUmpxQlpNR1o1VG1OTjNwdyJ9.g-ONPQ9uU6YpRIR9Pu8GSESL6jSMq5NDf-BS0ppNxcRMCpIhrguwrcI_KP-XpYKoPJ8EP3ZYTwxPjcCppuf888OF88zxUmd9qq-DQOvlYdzt_JqGN7tlsd9FEuOV-JUJOeF_ILrngp0PMNfK2OYkCUfjseOthLMtMELz_LKrwevgkYy4mrLXeJC4cxJZse0LM1UDqonjaiDQZ-ZuyPWykabWwmPKMWFdkxG-tQDG9yuHezKq6JKnnalzpZwNSUhswzoiOJbmonXEAe_GFV0WJCt6HGg2rYeuJRmecEYpk4troCmXjJmCgCpgSUz6yGYEX_zSbKRruY7FwH_mdmJzOA

2026-07-18 15:02:53	SUCCESS RFC6749-A.12	EnsureAccessTokenContainsAllowedCharactersOnly Access token does not contain any illegal characters

2026-07-18 15:02:53

(1) More

SUCCESS

RFC6749-5.1 RFC6749-6

ExtractExpiresInFromTokenEndpointResponse

Extracted 'expires_in'

expires_in

2026-07-18 15:02:53

(1) More

SUCCESS

RFC6749-5.1

ValidateExpiresIn

expires_in passed all validation checks

expires_in

2026-07-18 15:02:53

(2) More

SUCCESS

EnsureAccessTokenValuesAreDifferent

Access token values are not the same

second_access_token

eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6ImVlM2RhZTNmZmI4NzQwMzQifQ.eyJpc3MiOiJodHRwczovL3Bob25lLmNvZGViLmlvIiwic3ViIjoiY2xhdWRlIiwiYXVkIjoiY2xpZW50X3NlY3JldF9iYXNpYyIsImV4cCI6MTc4NDM5MDU3MiwiaWF0IjoxNzg0Mzg2OTcyLCJzY29wZSI6Im9wZW5pZCIsInJvbGUiOiJhZG1pbiIsImdyb3VwcyI6WyJhZG1pbiJdLCJhbXIiOlsicHdkIl0sImFjciI6InVybjpjb2RlYjphY3I6cHdkIiwidHlwIjoiYWNjZXNzIiwianRpIjoibDlLaFlpUmpxQlpNR1o1VG1OTjNwdyJ9.g-ONPQ9uU6YpRIR9Pu8GSESL6jSMq5NDf-BS0ppNxcRMCpIhrguwrcI_KP-XpYKoPJ8EP3ZYTwxPjcCppuf888OF88zxUmd9qq-DQOvlYdzt_JqGN7tlsd9FEuOV-JUJOeF_ILrngp0PMNfK2OYkCUfjseOthLMtMELz_LKrwevgkYy4mrLXeJC4cxJZse0LM1UDqonjaiDQZ-ZuyPWykabWwmPKMWFdkxG-tQDG9yuHezKq6JKnnalzpZwNSUhswzoiOJbmonXEAe_GFV0WJCt6HGg2rYeuJRmecEYpk4troCmXjJmCgCpgSUz6yGYEX_zSbKRruY7FwH_mdmJzOA

first_access_token

eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6ImVlM2RhZTNmZmI4NzQwMzQifQ.eyJpc3MiOiJodHRwczovL3Bob25lLmNvZGViLmlvIiwic3ViIjoiY2xhdWRlIiwiYXVkIjoiY2xpZW50X3NlY3JldF9iYXNpYyIsImV4cCI6MTc4NDM5MDU3MSwiaWF0IjoxNzg0Mzg2OTcxLCJzY29wZSI6Im9wZW5pZCIsInJvbGUiOiJhZG1pbiIsImdyb3VwcyI6WyJhZG1pbiJdLCJhbXIiOlsicHdkIl0sImFjciI6InVybjpjb2RlYjphY3I6cHdkIiwidHlwIjoiYWNjZXNzIiwianRpIjoiLU5CQWtJVkFFLVVMcE9FWk1LcUp3ZyJ9.yX-01GjFExmvV5vDTVwhjWk3Bcv9n9bi72hhZEkh6rnZnIbMh8ZAJp7jaYXJd3g2SxFqsedf9oKxWWqZ_xfafOYbzPf6QS6_QOKbOkgv9lR401xmNEgOA4I3YLQxKAcLen1llRHxLfsr4cjw6dkOkCHhFfjdn5KkAHZx7Dvj3Ft9CzhYGYx-YWuSInzeb-_CmotWBnPfC1yX-qtxUKE1H4MjIlKAgPf1JXQN66IxisRfsdqOHcR46zMG1xUGV96JpmCHvHouELsLWObk3gEfUCogfS0WOJD6F34425UBkktHFut15zTbkd-fqLnqX5IWpfOHT38O2rx4hHdAFGXffw

2026-07-18 15:02:53

(2) More

INFO

ValidateIdTokenFromTokenResponseEncryption

Skipped evaluation due to missing required object: client_jwks

mapped
expected	client_jwks

2026-07-18 15:02:53

(3) More

SUCCESS

ExtractIdTokenFromTokenResponse

Found and parsed the id_token from token_endpoint_response

value	eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6ImVlM2RhZTNmZmI4NzQwMzQifQ.eyJpc3MiOiJodHRwczovL3Bob25lLmNvZGViLmlvIiwic3ViIjoiY2xhdWRlIiwiYXVkIjoiY2xpZW50X3NlY3JldF9iYXNpYyIsImV4cCI6MTc4NDM5MDU3MiwiaWF0IjoxNzg0Mzg2OTcyLCJhdXRoX3RpbWUiOjE3ODQzODU3NTUsImFtciI6WyJwd2QiXSwiYWNyIjoidXJuOmNvZGViOmFjcjpwd2QifQ.ab_4qegDFWm6pzcfqsJCgRliBle1crM9_pu1_uWt_LMJIJOO_YZtTFXsxmJUHbP_FY6Zx7xKk0t6LNxP_Sd5pmZEZGqR6Kp-pO3QiBfA2pP2Ueo9exNTfijj6BzotZ9xbp3cjTbD8vbQSeQbuP37taz3mB4ijGs1-UJ3j4o6M9hstMt21Wm-Pzyy8aAOKRK1P7Z3sO7pxHfwk9sxNNbML4jM1xM2RsgYm8dfbjYy-na0fG_NbLr7p4UXvCAFjcdq4--_qadfNmNaULupTSuETOmH0xl7_CwtCA51d9pCiIWv-pVUFjE7K-SjWnxL0-zrFp4YA_ZTdP0LurLRVCXaeQ
header	{ "kid": "ee3dae3ffb874034", "typ": "JWT", "alg": "RS256" }
claims	{ "sub": "claude", "aud": "client_secret_basic", "acr": "urn:codeb:acr:pwd", "auth_time": 1784385755, "amr": [ "pwd" ], "iss": "https://phone.codeb.io", "exp": 1784390572, "iat": 1784386972 }

2026-07-18 15:02:53

(1) More

SUCCESS

ExtractRefreshTokenFromTokenResponse

Extracted refresh token from response

refresh_token

cL9pL6OdCdI9LZASV7MXVAxUeGn9RsG_AgPeKjq8MSo

2026-07-18 15:02:53

(2) More

SUCCESS

RFC6749-10.10

EnsureMinimumRefreshTokenLength

Refresh token is of sufficient length

actual	344
required	128

2026-07-18 15:02:53

(3) More

SUCCESS

RFC6749-10.10

EnsureMinimumRefreshTokenEntropy

Calculated shannon entropy seems sufficient

actual	207.06472194569977
expected	96.0
value	cL9pL6OdCdI9LZASV7MXVAxUeGn9RsG_AgPeKjq8MSo

2026-07-18 15:02:53

(6) More

SUCCESS

OIDCC-12.2

CompareIdTokenClaims

Validated id token claims successfully

iss	{ "first": "https://phone.codeb.io", "second": "https://phone.codeb.io", "note": "Values are expected to be equal" }
sub	{ "first": "claude", "second": "claude", "note": "Values are expected to be equal" }
iat	{ "first": 1784386971, "second": 1784386972, "note": "Values are expected to be different" }
aud	{ "first": "client_secret_basic", "second": "client_secret_basic", "note": "Values are expected to be equal" }
auth_time	{ "first": 1784385755, "second": 1784385755, "note": "Values are expected to be equal" }
azp	Id tokens do not contain azp claims

Second client: Userinfo endpoint tests

2026-07-18 15:02:53

(4) More

CallProtectedResource

HTTP request

request_uri	https://phone.codeb.io/oauth2/v1/userinfo
request_method	GET
request_headers	{ "Accept": "application/json", "Authorization": "Bearer eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6ImVlM2RhZTNmZmI4NzQwMzQifQ.eyJpc3MiOiJodHRwczovL3Bob25lLmNvZGViLmlvIiwic3ViIjoiY2xhdWRlIiwiYXVkIjoiY2xpZW50X3NlY3JldF9iYXNpYyIsImV4cCI6MTc4NDM5MDU3MiwiaWF0IjoxNzg0Mzg2OTcyLCJzY29wZSI6Im9wZW5pZCIsInJvbGUiOiJhZG1pbiIsImdyb3VwcyI6WyJhZG1pbiJdLCJhbXIiOlsicHdkIl0sImFjciI6InVybjpjb2RlYjphY3I6cHdkIiwidHlwIjoiYWNjZXNzIiwianRpIjoibDlLaFlpUmpxQlpNR1o1VG1OTjNwdyJ9.g-ONPQ9uU6YpRIR9Pu8GSESL6jSMq5NDf-BS0ppNxcRMCpIhrguwrcI_KP-XpYKoPJ8EP3ZYTwxPjcCppuf888OF88zxUmd9qq-DQOvlYdzt_JqGN7tlsd9FEuOV-JUJOeF_ILrngp0PMNfK2OYkCUfjseOthLMtMELz_LKrwevgkYy4mrLXeJC4cxJZse0LM1UDqonjaiDQZ-ZuyPWykabWwmPKMWFdkxG-tQDG9yuHezKq6JKnnalzpZwNSUhswzoiOJbmonXEAe_GFV0WJCt6HGg2rYeuJRmecEYpk4troCmXjJmCgCpgSUz6yGYEX_zSbKRruY7FwH_mdmJzOA", "Content-Length": "0" }
request_body

2026-07-18 15:02:53

(4) More

RESPONSE

CallProtectedResource

HTTP response

response_status_code	200 OK
response_status_text	OK
response_headers	{ "cache-control": "private, no-store,no-store, no-cache, must-revalidate, max-age\u003d0", "pragma": "no-cache,no-cache", "content-type": "application/json; charset\u003dutf-8", "expires": "0", "x-aspnet-version": "4.0.30319", "referrer-policy": "no-referrer", "x-content-type-options": "nosniff", "permissions-policy": "camera\u003d(self), microphone\u003d(self), display-capture\u003d(self)", "strict-transport-security": "max-age\u003d63072000; includeSubDomains", "date": "Sat, 18 Jul 2026 15:02:52 GMT", "content-length": "46" }
response_body	{"sub":"claude","preferred_username":"claude"}

2026-07-18 15:02:53

(4) More

SUCCESS

CallProtectedResource

Got a response from the resource endpoint

status	200
endpoint_name	resource
headers	{ "cache-control": "private, no-store,no-store, no-cache, must-revalidate, max-age\u003d0", "pragma": "no-cache,no-cache", "content-type": "application/json; charset\u003dutf-8", "expires": "0", "x-aspnet-version": "4.0.30319", "referrer-policy": "no-referrer", "x-content-type-options": "nosniff", "permissions-policy": "camera\u003d(self), microphone\u003d(self), display-capture\u003d(self)", "strict-transport-security": "max-age\u003d63072000; includeSubDomains", "date": "Sat, 18 Jul 2026 15:02:52 GMT", "content-length": "46" }
body	{"sub":"claude","preferred_username":"claude"}

2026-07-18 15:02:53

(2) More

SUCCESS

EnsureHttpStatusCodeIs200

resource endpoint returned the expected http status

http_status	200
expected_status	200

Attempting to use refresh_token issued to client 2 with client 1

2026-07-18 15:02:53

(2) More

SUCCESS

CreateRefreshTokenRequest

Created token endpoint request parameters

grant_type	refresh_token
refresh_token	cL9pL6OdCdI9LZASV7MXVAxUeGn9RsG_AgPeKjq8MSo

2026-07-18 15:02:53

(3) More

SUCCESS

RFC6749-6

AddScopeToTokenEndpointRequest

Added scope of 'openid' to token endpoint request

grant_type	refresh_token
refresh_token	cL9pL6OdCdI9LZASV7MXVAxUeGn9RsG_AgPeKjq8MSo
scope	openid

2026-07-18 15:02:53

(1) More

SUCCESS

AddBasicAuthClientSecretToRequest

Added basic authorization header

Authorization

Basic b2lkZi1jb25mLWJhc2ljOlc2T2FnX1NmRjhUOUNLanlRbEJ6M2ZTeVJDUE42MGJwYTZ2TDQ0NTZ5cm8=

2026-07-18 15:02:53

(4) More

CallTokenEndpointAndReturnFullResponse

HTTP request

request_uri	https://phone.codeb.io/oauth2/v1/token
request_method	POST
request_headers	{ "Accept": "application/json", "Authorization": "Basic b2lkZi1jb25mLWJhc2ljOlc2T2FnX1NmRjhUOUNLanlRbEJ6M2ZTeVJDUE42MGJwYTZ2TDQ0NTZ5cm8\u003d", "Content-Type": "application/x-www-form-urlencoded", "Content-Length": "95" }
request_body	grant_type=refresh_token&refresh_token=cL9pL6OdCdI9LZASV7MXVAxUeGn9RsG_AgPeKjq8MSo&scope=openid

2026-07-18 15:02:54

(4) More

RESPONSE

CallTokenEndpointAndReturnFullResponse

HTTP response

response_status_code	400 BAD_REQUEST
response_status_text	Bad Request
response_headers	{ "cache-control": "private, no-store,no-store, no-cache, must-revalidate, max-age\u003d0", "pragma": "no-cache", "content-type": "application/json; charset\u003dutf-8", "expires": "0", "x-aspnet-version": "4.0.30319", "referrer-policy": "no-referrer", "x-content-type-options": "nosniff", "permissions-policy": "camera\u003d(self), microphone\u003d(self), display-capture\u003d(self)", "strict-transport-security": "max-age\u003d63072000; includeSubDomains", "date": "Sat, 18 Jul 2026 15:02:53 GMT", "content-length": "66" }
response_body	{"error":"invalid_grant","error_description":"client_id mismatch"}

2026-07-18 15:02:54

(5) More

SUCCESS

CallTokenEndpointAndReturnFullResponse

Parsed token endpoint response

status	400
endpoint_name	https://phone.codeb.io/oauth2/v1/token
headers	{ "cache-control": "private, no-store,no-store, no-cache, must-revalidate, max-age\u003d0", "pragma": "no-cache", "content-type": "application/json; charset\u003dutf-8", "expires": "0", "x-aspnet-version": "4.0.30319", "referrer-policy": "no-referrer", "x-content-type-options": "nosniff", "permissions-policy": "camera\u003d(self), microphone\u003d(self), display-capture\u003d(self)", "strict-transport-security": "max-age\u003d63072000; includeSubDomains", "date": "Sat, 18 Jul 2026 15:02:53 GMT", "content-length": "66" }
body	{"error":"invalid_grant","error_description":"client_id mismatch"}
body_json	{ "error": "invalid_grant", "error_description": "client_id mismatch" }

2026-07-18 15:02:54

(1) More

SUCCESS

ValidateErrorFromTokenEndpointResponseError

Token endpoint response error returned valid 'error' field

error

invalid_grant

2026-07-18 15:02:54	SUCCESS OIDCC-3.1.3.4	CheckTokenEndpointHttpStatus400 Token endpoint http status code was 400

2026-07-18 15:02:54	SUCCESS OIDCC-3.1.3.4	CheckTokenEndpointReturnedJsonContentType token_endpoint_response_headers Content-Type: header is application/json

2026-07-18 15:02:54

(1) More

SUCCESS

RFC6749-5.2

CheckErrorFromTokenEndpointResponseErrorInvalidGrant

token_endpoint_response error returned expected 'error' of 'invalid_grant'

expected

[
  "invalid_grant"
]

2026-07-18 15:02:54

(1) More

FINISHED

oidcc-refresh-token

Test has run to completion

testmodule_result

PASSED

2026-07-18 15:03:20

(2) More

TEST-RUNNER

Alias has now been claimed by another test

alias	codeb
new_test_id	RSB2v5PpJn5Yafx

Test Summary

Test Results