OIDC Relying-Party Authorization Request and Redirect-URI Consistency Gate

This Actor checks the login redirect of an app that uses OpenID Connect (OIDC). Use it after a change to a proxy, an ingress, TLS termination, a host name, or an EXTERNAL_URL-type setting.

For each login URL, the Actor sends one GET request. It does not follow redirects. It reads only the first 3xx response. It then compares the authorization request in the Location header with your expected values.

The Actor does not log in. It does not use credentials or secrets. It does not use a browser.

What the Actor checks

Check name	Failure condition
first-hop	The first response is not a 3xx redirect, or the redirect is not an authorization request (no response_type and no client_id).
redirect-uri	redirect_uri is not exactly equal to expectedRedirectUri.
client-id	client_id is not equal to expectedClientId. The check runs only if you set expectedClientId.
authorize-endpoint	The authorization URL differs from authorization_endpoint in the discovery document.
discovery	You set issuer, but the discovery document could not be read.
pkce	requirePkce is true and the request has no S256 code challenge.
state	The request has no state.
nonce	The request has no nonce.
fetch	The request failed (timeout, DNS error, private target, and so on).
input	The entry in the input is not valid.

A failed check gives verdict: "fail" in the dataset. The run itself still succeeds.

Input

• entries (1 to 200): each entry has loginUrl, expectedRedirectUri, and optional expectedClientId, hostVariants, and issuer.
• hostVariants (maximum 3): a host name (for example app2.example.org) a scheme://host value (for example http://app.example.org), or a scheme only (http, https, or http://). The Actor replaces the scheme and host of loginUrl and keeps the path and query. A scheme-only value changes only the scheme and keeps the host and port of loginUrl. The expected values stay the same.
• issuer: the Actor fetches <issuer>/.well-known/openid-configuration once for each distinct issuer in the run.
• requirePkce: default true.
• stateStoreName: optional. The Actor saves the last parameters of each target in this key-value store. Each item then has changeEvents[] with field, previous, and current. The first run gives an empty list.

An empty input runs the default fixture: https://example.com/login. That page is not an OIDC login. The default run gives a fail verdict (first-hop) and the run succeeds.

Output

One dataset item for each entry and host variant. Fields: loginUrl, firstHopStatus, authorizeHost, authorizeEndpointMatchesDiscovery, redirectUri, redirectUriMatchesExpected, redirectUriScheme, clientIdMatches, pkceMethod (S256, plain, or none), hasState, hasNonce, scope, responseType, verdict, failedChecks, and changeEvents (only if the state store is set). A failed request also has error.

The key-value store record SUMMARY has checked, passed, failed, skipped, failCountByCheck, and stoppedByChargeLimit.

Pricing event

Event name	When the Actor charges	Price (proposal)
entry-checked	One time for each login entry URL and host variant that the Actor checks. The Actor writes one dataset item for it.	USD 0.004

The Actor does not charge for an entry that the input check rejects. If the maximum charge is reached, the Actor stops, and SUMMARY shows stoppedByChargeLimit: true and the number of skipped targets. The default maximum charge of USD 2.00 covers 500 checks. Increase it for large inputs.

Safety limits

• The Actor accepts only http and https URLs without credentials.
• The Actor rejects a host that resolves to a private or reserved address (loopback, private, link-local, carrier-grade NAT, and others).
• It reads at most 1 MB from a response, with a timeout of 15 seconds.
• It follows no redirect. It runs at most 5 requests at the same time.

Limits

• The Actor checks only leg 1 (the authorization request). It cannot find a mismatch that exists only in the token exchange (leg 2).
• The Actor checks the address once, before it connects. A DNS change between the check and the connection is not detected.
• If the app starts an OIDC login only after more than one redirect, the first-hop check fails.
• The Actor requires nonce, as the contract states. Some code-flow apps do not send a nonce. Treat that result as expected for such an app.

Development

uv run pytest
uv run ruff check .