userinfo-endpoint-reviewer

Testing OpenID Connect UserInfo endpoint access token validation involves reviewing Bearer token handling and verifying token enforcement across GET and POST requests. This identifies missing test coverage for token validation based on OIDC Core sections 5.3-5.4.

Sub claim consistency validation in OpenID Connect UserInfo testing verifies that the sub claim returned by the UserInfo endpoint matches the sub claim present in the ID Token. Documenting this gap ensures reliable subject identification across tokens.

To verify scope-based claims returned by the UserInfo endpoint, you review test cases against granted scopes to ensure the endpoint only returns appropriate claims. This process documents gaps in scope-driven response accuracy per OIDC Core section 5.4.

The OpenID Connect UserInfo endpoint supports both GET and POST requests for retrieving user claims. Reviewing test coverage for both HTTP methods identifies gaps in Bearer token handling and access token validation across different request types.

Common testing gaps for signed UserInfo responses in OpenID Connect include missing test cases for optional signed response validation. Reviewing test coverage identifies whether your tests verify signature integrity when signed responses are configured for the UserInfo endpoint.

OIDC Core sections 5.3 and 5.4 cover UserInfo endpoint testing requirements, including access token validation, Bearer token handling, sub claim consistency, and scope-based claims. Aligning test gaps with these sections ensures comprehensive endpoint coverage.