OidcConfigAudit / report
OidcConfigAudit report: https://login.demo-saas.example/.well-known/openid-configuration
Demo report on a fictional sample site.
64 / 100
5 of 11 checks need attention (1 high priority).
- ✓ Discovery document has every required field (high): All required fields present.
- ✓ issuer exactly matches the discovery URL (high): issuer: https://login.demo-saas.example/.
- ✓ Every endpoint uses HTTPS (high): All HTTPS.
- ✗ PKCE with S256 advertised (high): Not advertised.
- ✗ No implicit-flow response types (medium): Implicit/hybrid types: token, id_token token.
- ✗ No resource-owner password grant (medium): grant_types_supported: authorization_code, password, refresh_token.
- ✓ Safe ID token signing algorithms (high): id_token_signing_alg_values_supported: RS256, HS256.
- ✓ JWKS reachable with key IDs (high): 1 key(s), 1 with kid.
- ✓ No private key material in the JWKS (high): Public keys only.
- ✗ RSA keys are 2048 bits or more (medium): RSA sizes: 1024 bits.
- ✗ A second signing key published for rotation (low): 1 signing key(s).
Reads only the public discovery document and JWKS (2 requests); nothing is logged into or tested actively. Configuration evidence for your review, not a penetration test.