OAuth discovery documents

What the scanner requests

• /.well-known/oauth-authorization-server
• /.well-known/openid-configuration
• /.well-known/oauth-protected-resource

What is measured

The scanner GETs /.well-known/oauth-authorization-server, /.well-known/openid-configuration and /.well-known/oauth-protected-resource with no credentials. It passes when one of them returns JSON matching the format for that path: RFC 8414 or OpenID Connect metadata carrying issuer, authorization_endpoint, token_endpoint and response_types_supported, or RFC 9728 protected resource metadata carrying resource and authorization_servers. For protected resource metadata, the scan also requests the RFC 8414 metadata of the same-origin authorization servers it names, up to a published cap. It partially passes when a document is served at a valid path but omits a member required for that format, or when every same-origin authorization server whose metadata the scan requested publishes none with issuer and token_endpoint. An authorization server on another origin, or one whose metadata was not requested, does not change the outcome, and the detail names it as not requested.

Reproduce it yourself

You do not have to take our word for any of this. Run the same measurement against your own domain:

              DOMAIN=https://your-domain.example
for p in /.well-known/oauth-authorization-server /.well-known/openid-configuration /.well-known/oauth-protected-resource; do printf '%s -> ' "$p"; curl -sS "$DOMAIN$p" | jq -c '{issuer,token_endpoint,resource,authorization_servers}' 2>/dev/null || echo "missing or not JSON"; done
            

The fix

This is the artifact to ship. It is the complete change, not a description of one.

              {
  "resource": "https://api.your-domain.example/",
  "resource_name": "Example API",
  "resource_logo_uri": "https://your-domain.example/logo.png",
  "authorization_servers": ["https://auth.your-domain.example/"],
  "scopes_supported": ["api.read", "api.write"],
  "bearer_methods_supported": ["header"]
}
            

Standards referenced

• RFC 8414
• RFC 9728

Related checks