# oidcconfigaudit report: https://login.demo-saas.example/.well-known/openid-configuration

> Demo report on a fictional sample site.

**Score:** 64/100 · Scanned 2026-10-27T23:14:04.958Z

5 of 11 checks need attention (1 high priority).

- [x] **Discovery document has every required field** (high): All required fields present.
- [x] **issuer exactly matches the discovery URL** (high): issuer: https://login.demo-saas.example/.
- [x] **Every endpoint uses HTTPS** (high): All HTTPS.
- [ ] **PKCE with S256 advertised** (high): Not advertised.
- [ ] **No implicit-flow response types** (medium): Implicit/hybrid types: token, id_token token.
- [ ] **No resource-owner password grant** (medium): grant_types_supported: authorization_code, password, refresh_token.
- [x] **Safe ID token signing algorithms** (high): id_token_signing_alg_values_supported: RS256, HS256.
- [x] **JWKS reachable with key IDs** (high): 1 key(s), 1 with kid.
- [x] **No private key material in the JWKS** (high): Public keys only.
- [ ] **RSA keys are 2048 bits or more** (medium): RSA sizes: 1024 bits.
- [ ] **A second signing key published for rotation** (low): 1 signing key(s).

---
Reads only the public discovery document and JWKS (2 requests); nothing is logged into or tested actively. Configuration evidence for your review, not a penetration test.