Pricing

Pay per usage

Try for free

Go to Apify Store

Change Password Well-Known URL Auditor

Try for free

Audit a domain's /.well-known/change-password redirect against the W3C spec. Verify the target loads and get a readiness score.

Pricing

Pay per usage

Rating

0.0

(0)

Developer

Sanskar Jaiswal

Actor stats

Bookmarked

Total users

Monthly active users

18 days ago

Last modified

HTTP Security Headers Auditor

phoenix2810/http-security-headers-auditor

Audit a public website's HTTP security response headers in one API call. Returns a letter grade, numeric score, per-header analysis, and actionable recommendations. Built for security teams, devops, and site migration QA.

Sanskar Jaiswal

Redirect Chain Analyzer

predictable_function/my-actor-2

List of URLs whose HTTP redirect chains will be analyzed

riya rawat

5.0

(1)

Security.txt Auditor

phoenix2810/security-txt-auditor

Audit a public website's security.txt vulnerability disclosure metadata. Checks discovery paths, required fields, expiration, contact methods, and returns a readiness score with recommendations.

Sanskar Jaiswal

Content-Security-Policy Auditor

phoenix2810/csp-auditor

Deeply audit a public URL's Content-Security-Policy and Content-Security-Policy-Report-Only headers. Parses directives and sources, flags unsafe-inline, unsafe-eval, non-HTTPS sources, wildcards, missing default-src and frame-ancestors, nonces, hashes, and deprecated directives.

Sanskar Jaiswal

✨LLMO & AI Search Auditor - /llms.txt [ChatGPT/Perplexity]

invaluable_rondeau/llmo-ai-search-readiness-auditor

✅ Score any domain (0-100) for ChatGPT Search, Perplexity, Claude & Gemini citation readiness ($15/1k domains). ✅ Audits /llms.txt, robots.txt AI crawlers (GPTBot/ClaudeBot), Schema.org JSON-LD & auto-generates a ready-to-deploy /llms.txt file.

PROOFNEXA

AI Crawler Robots.txt Auditor

phoenix2810/ai-crawler-robots-auditor

Fetch a public website's robots.txt and report which AI crawlers (GPTBot, ClaudeBot, Google-Extended, PerplexityBot, CCBot, Bytespider, and more) are blocked, allowed, or defaulted. Returns an AI-visibility readiness score with recommendations for GEO and AI-SEO strategy.

Sanskar Jaiswal

VoicePilot — Voice Search Readiness Auditor

orbitai/voice-search-readiness-auditor

Checks how well a business website is structured and optimized for conversational AI engines and voice assistants (Gemini, Siri, Alexa).

Daniel Lozano

Redirect Chain Auditor

phoenix2810/redirect-chain-auditor

Audit a public URL's redirect chain in one API call. Reports hops, final status, HTTPS downgrades, temporary redirects, loops, score, and recommendations for SEO and migration QA.

Sanskar Jaiswal

Content-Type & X-Content-Type-Options Auditor

phoenix2810/content-type-auditor

Audit one public URL for Content-Type accuracy, X-Content-Type-Options nosniff, and MIME confusion risk via magic-byte sniffing.

Sanskar Jaiswal

Speculation Rules Auditor

phoenix2810/speculation-rules-auditor

Audit a public page for Speculation Rules API usage: inline <script type="speculationrules"> blocks and the Speculation-Rules HTTP header. Returns per-rule analysis, eagerness, issues, score, grade, and Core Web Vitals recommendations.

Sanskar Jaiswal

{ "name": "change-password-well-known-auditor", "version": "0.1.0", "description": "Apify Actor that audits a public domain's /.well-known/change-password endpoint against the W3C/WHATWG Well-Known URL for Changing Passwords specification. Checks for a spec-conforming redirect to the real password-change page, verifies the target loads, and returns a readiness score, letter grade, issues, and recommendations.", "type": "module", "private": true, "main": "src/main.js", "scripts": { "start": "node src/main.js", "test": "node --test test/*.test.js", "lint": "node --check src/main.js" }, "dependencies": { "apify": "^3.4.5" }, "devDependencies": {} }

1import { Actor } from 'apify'; 2import dns from 'node:dns/promises'; 3import net from 'node:net'; 4import { fileURLToPath } from 'node:url'; 5 6const USER_AGENT = 'ChangePasswordWellKnownAuditor/0.1 (+https://apify.com)'; 7const DEFAULT_TIMEOUT_SECONDS = 10; 8const WELL_KNOWN_PATH = '/.well-known/change-password'; 9 10/* --------------------------------------------------------------------------- 11 * SSRF protection — shared pattern used across URL-fetching factory actors. 12 * Allows only HTTP/HTTPS, rejects URL credentials, rejects localhost/private 13 * IP literals, DNS-resolves hostnames, and rejects DNS that resolves to 14 * private IP ranges. 15 * ------------------------------------------------------------------------- */ 16 17function isPrivateIPv4(ip) { 18 const parts = ip.split('.').map(Number); 19 if (parts.length !== 4 || parts.some((n) => Number.isNaN(n))) return false; 20 const [a, b] = parts; 21 return a === 10 22 || (a === 172 && b >= 16 && b <= 31) 23 || (a === 192 && b === 168) 24 || a === 127 25 || a === 0 26 || (a === 169 && b === 254); 27} 28 29function isPrivateIPv6(ip) { 30 const normalized = ip.toLowerCase(); 31 return normalized === '::1' 32 || normalized.startsWith('fc') 33 || normalized.startsWith('fd') 34 || normalized.startsWith('fe80:'); 35} 36 37export async function normalizeAndValidateUrl(rawUrl) { 38 if (!rawUrl || typeof rawUrl !== 'string') throw new Error('URL is required'); 39 if (/^[a-z][a-z0-9+.-]*:/i.test(rawUrl) && !/^https?:\/\//i.test(rawUrl)) { 40 throw new Error('Only HTTP and HTTPS URLs are supported'); 41 } 42 const withScheme = /^https?:\/\//i.test(rawUrl) ? rawUrl : `https://${rawUrl}`; 43 const url = new URL(withScheme); 44 if (!['http:', 'https:'].includes(url.protocol)) throw new Error('Only HTTP and HTTPS URLs are supported'); 45 if (!url.hostname || url.username || url.password) throw new Error('URL must be public and must not include credentials'); 46 47 // Node's URL keeps brackets on IPv6 literals ([::1]); strip for IP checks. 48 const hostLiteral = url.hostname.startsWith('[') && url.hostname.endsWith(']') 49 ? url.hostname.slice(1, -1) 50 : url.hostname; 51 52 const literalType = net.isIP(hostLiteral); 53 if (literalType === 4 && isPrivateIPv4(hostLiteral)) throw new Error('Private IPv4 targets are blocked'); 54 if (literalType === 6 && isPrivateIPv6(hostLiteral)) throw new Error('Private IPv6 targets are blocked'); 55 56 const records = literalType ? [{ address: hostLiteral, family: literalType }] : await dns.lookup(url.hostname, { all: true }); 57 for (const record of records) { 58 if (record.family === 4 && isPrivateIPv4(record.address)) throw new Error('DNS resolves to a private IPv4 address; blocked for SSRF safety'); 59 if (record.family === 6 && isPrivateIPv6(record.address)) throw new Error('DNS resolves to a private IPv6 address; blocked for SSRF safety'); 60 } 61 return url; 62} 63 64/* --------------------------------------------------------------------------- 65 * HTTP fetch with manual redirect inspection (SSRF-safe). 66 * Unlike most factory actors, this one does NOT auto-follow redirects: the 67 * spec requires /.well-known/change-password to BE a redirect, so the first 68 * hop's status/Location are the primary signal. Each redirect target is 69 * still revalidated through normalizeAndValidateUrl before being reported 70 * or optionally followed one hop further for final-destination reporting. 71 * ------------------------------------------------------------------------- */ 72 73async function fetchOnce(targetUrl, timeoutSeconds) { 74 await normalizeAndValidateUrl(targetUrl.href); 75 const controller = new AbortController(); 76 const timeout = setTimeout(() => controller.abort(), timeoutSeconds * 1000); 77 try { 78 const response = await fetch(targetUrl, { 79 redirect: 'manual', 80 signal: controller.signal, 81 headers: { 'user-agent': USER_AGENT, accept: 'text/html,application/xhtml+xml,*/*;q=0.1' }, 82 }); 83 let bodySample = ''; 84 try { 85 const buf = await response.arrayBuffer(); 86 bodySample = Buffer.from(buf).toString('utf8', 0, Math.min(buf.byteLength, 2048)); 87 } catch { /* drain/ignore */ } 88 return { 89 ok: true, 90 status: response.status, 91 headers: response.headers, 92 location: response.headers.get('location'), 93 contentType: response.headers.get('content-type'), 94 bodySample, 95 finalUrl: response.url || targetUrl.href, 96 error: null, 97 }; 98 } catch (error) { 99 return { 100 ok: false, 101 status: null, 102 headers: null, 103 location: null, 104 contentType: null, 105 bodySample: '', 106 finalUrl: targetUrl.href, 107 error: error.message, 108 }; 109 } finally { 110 clearTimeout(timeout); 111 } 112} 113 114/* --------------------------------------------------------------------------- 115 * Classify the well-known response against the W3C/WHATWG 116 * "A Well-Known URL for Changing Passwords" spec 117 * (https://w3c.github.io/webappsec-change-password-url/). 118 * 119 * The spec requires conforming sites to serve a response at 120 * /.well-known/change-password that redirects (3xx with Location) to the 121 * site's actual password-change page. A 404/other error means the site does 122 * not support the convention. A 200 response (no redirect) is a common 123 * real-world deviation: some sites serve the change-password form directly 124 * at the well-known path instead of redirecting to it — this still lets 125 * password managers deep-link successfully, so it is scored as a partial 126 * pass rather than a hard failure. 127 * ------------------------------------------------------------------------- */ 128 129const REDIRECT_STATUSES = new Set([301, 302, 303, 307, 308]); 130 131export function classifyWellKnownResponse(fetchResult, wellKnownUrl, redirectLocation) { 132 if (!fetchResult.ok) { 133 return { classification: 'unreachable', isRedirect: false, isDirectServe: false }; 134 } 135 if (fetchResult.status === 404 || fetchResult.status === 410) { 136 return { classification: 'not-found', isRedirect: false, isDirectServe: false }; 137 } 138 if (REDIRECT_STATUSES.has(fetchResult.status)) { 139 if (!fetchResult.location) { 140 return { classification: 'redirect-missing-location', isRedirect: true, isDirectServe: false }; 141 } 142 return { classification: 'redirect', isRedirect: true, isDirectServe: false }; 143 } 144 if (fetchResult.status >= 200 && fetchResult.status < 300) { 145 return { classification: 'direct-serve', isRedirect: false, isDirectServe: true }; 146 } 147 return { classification: 'unexpected-status', isRedirect: false, isDirectServe: false }; 148} 149 150/* --------------------------------------------------------------------------- 151 * Score and grade well-known change-password readiness. 152 * ------------------------------------------------------------------------- */ 153 154export function scoreAudit(analysis) { 155 const issues = []; 156 const recommendations = []; 157 const { 158 classification, https, sameOriginRedirect, redirectIsHttps, 159 redirectTargetReachable, redirectTargetStatus, contentType, 160 } = analysis; 161 162 if (classification === 'unreachable') { 163 issues.push('The well-known URL could not be reached (network error, timeout, or TLS failure).'); 164 recommendations.push('Verify the host is reachable over HTTPS and serves /.well-known/change-password.'); 165 return finalize(0, issues, recommendations); 166 } 167 168 if (classification === 'not-found') { 169 issues.push('No resource was found at /.well-known/change-password (404/410). The site does not support the well-known change-password convention, so password managers cannot deep-link users to the password-change page.'); 170 recommendations.push('Serve /.well-known/change-password as a redirect (HTTP 301/302/307/308 with a Location header) to the site\'s password-change page, per the W3C "A Well-Known URL for Changing Passwords" specification.'); 171 return finalize(10, issues, recommendations); 172 } 173 174 if (classification === 'unexpected-status') { 175 issues.push(`The well-known URL returned an unexpected HTTP status (${analysis.status}). Neither a redirect nor a successful direct page was served.`); 176 recommendations.push('Return either a 3xx redirect with Location to the password-change page, or a 200 response that serves the password-change page directly.'); 177 return finalize(20, issues, recommendations); 178 } 179 180 if (classification === 'redirect-missing-location') { 181 issues.push('The well-known URL responded with a redirect status code but no Location header. Password managers cannot follow a redirect without one.'); 182 recommendations.push('Include a Location header pointing to the password-change page on every 3xx response from /.well-known/change-password.'); 183 return finalize(25, issues, recommendations); 184 } 185 186 let score = 0; 187 188 if (classification === 'redirect') { 189 score = 85; 190 if (!https) { 191 score -= 15; 192 issues.push('The well-known URL was requested over plain HTTP. Password managers and the spec expect HTTPS.'); 193 recommendations.push('Serve /.well-known/change-password only over HTTPS.'); 194 } 195 if (redirectIsHttps === false) { 196 score -= 20; 197 issues.push('The redirect Location points to a plain HTTP URL, downgrading the connection away from HTTPS.'); 198 recommendations.push('Point the redirect Location at an HTTPS URL.'); 199 } 200 if (sameOriginRedirect === false) { 201 score -= 10; 202 issues.push('The redirect Location points to a different host than the one audited. This is allowed by the spec but is unusual and worth verifying intentionally.'); 203 recommendations.push('Confirm the cross-host redirect target is the correct, trusted password-change page for this site.'); 204 } 205 if (redirectTargetReachable === false) { 206 score -= 25; 207 issues.push(`Following the redirect target did not return a successful response (status: ${redirectTargetStatus ?? 'unreachable'}). Password managers following the redirect would land on a broken page.`); 208 recommendations.push('Verify the redirect target page itself loads successfully (HTTP 2xx).'); 209 } 210 } else if (classification === 'direct-serve') { 211 score = 60; 212 issues.push('The well-known URL returned a 200 response directly instead of redirecting to a password-change page. This deviates from the spec\'s redirect model, though many password managers will still treat a 200 response as a usable landing page.'); 213 recommendations.push('Prefer redirecting /.well-known/change-password (3xx + Location) to the canonical password-change page rather than serving content directly, for maximum compatibility with the specification.'); 214 if (!https) { 215 score -= 15; 216 issues.push('The well-known URL was requested over plain HTTP.'); 217 recommendations.push('Serve /.well-known/change-password only over HTTPS.'); 218 } 219 if (contentType && !/text\/html/i.test(contentType)) { 220 score -= 10; 221 issues.push(`The direct response has Content-Type "${contentType}", not an HTML page. Password managers expect to land on a human-usable password-change form.`); 222 recommendations.push('Serve an HTML password-change page at this well-known path.'); 223 } 224 } 225 226 return finalize(score, issues, recommendations); 227} 228 229function finalize(score, issues, recommendations) { 230 const bounded = Math.max(0, Math.min(100, score)); 231 const grade = bounded >= 95 ? 'A+' 232 : bounded >= 85 ? 'A' 233 : bounded >= 75 ? 'B' 234 : bounded >= 65 ? 'C' 235 : bounded >= 50 ? 'D' 236 : bounded >= 30 ? 'E' 237 : 'F'; 238 239 if (bounded >= 85 && issues.length === 0) { 240 recommendations.push('The /.well-known/change-password convention is correctly implemented. Periodically re-check after deploys or identity-provider migrations.'); 241 } 242 if (recommendations.length === 0 && issues.length === 0) { 243 recommendations.push('No issues detected.'); 244 } 245 return { score: bounded, grade, issues, recommendations }; 246} 247 248/* --------------------------------------------------------------------------- 249 * Main audit pipeline. 250 * 1. Fetch https://<host>/.well-known/change-password without following 251 * redirects, per the W3C change-password-url specification. 252 * 2. If it is a redirect, revalidate the Location through SSRF checks and 253 * perform one additional fetch to confirm the target page itself loads. 254 * ------------------------------------------------------------------------- */ 255 256export async function auditChangePasswordWellKnown(input) { 257 const timeoutSeconds = Math.min(Math.max(Number(input.timeoutSeconds || DEFAULT_TIMEOUT_SECONDS), 3), 30); 258 const followRedirectTarget = input.followRedirectTarget !== false; 259 260 let startUrl; 261 try { 262 startUrl = await normalizeAndValidateUrl(input.startUrl); 263 } catch (validationError) { 264 return errorResult(input.startUrl, validationError.message); 265 } 266 267 const wellKnownUrl = new URL(WELL_KNOWN_PATH, `${startUrl.protocol}//${startUrl.host}/`); 268 269 let fetched; 270 try { 271 fetched = await fetchOnce(wellKnownUrl, timeoutSeconds); 272 } catch (fetchError) { 273 return errorResult(input.startUrl, fetchError.message, wellKnownUrl.href); 274 } 275 276 if (!fetched.ok) { 277 return errorResult(input.startUrl, fetched.error, wellKnownUrl.href); 278 } 279 280 const { classification, isRedirect, isDirectServe } = classifyWellKnownResponse(fetched, wellKnownUrl, fetched.location); 281 282 let redirectTargetUrl = null; 283 let redirectIsHttps = null; 284 let sameOriginRedirect = null; 285 let redirectTargetReachable = null; 286 let redirectTargetStatus = null; 287 let redirectTargetError = null; 288 289 if (isRedirect && classification === 'redirect' && fetched.location) { 290 try { 291 redirectTargetUrl = new URL(fetched.location, wellKnownUrl.href); 292 redirectIsHttps = redirectTargetUrl.protocol === 'https:'; 293 sameOriginRedirect = redirectTargetUrl.host === wellKnownUrl.host; 294 295 if (followRedirectTarget) { 296 const targetFetch = await fetchOnce(redirectTargetUrl, timeoutSeconds); 297 if (targetFetch.ok) { 298 redirectTargetReachable = targetFetch.status >= 200 && targetFetch.status < 400; 299 redirectTargetStatus = targetFetch.status; 300 } else { 301 redirectTargetReachable = false; 302 redirectTargetError = targetFetch.error; 303 } 304 } 305 } catch (targetError) { 306 redirectTargetReachable = false; 307 redirectTargetError = targetError.message; 308 } 309 } 310 311 const analysis = { 312 classification, 313 status: fetched.status, 314 https: wellKnownUrl.protocol === 'https:', 315 sameOriginRedirect, 316 redirectIsHttps, 317 redirectTargetReachable, 318 redirectTargetStatus, 319 contentType: fetched.contentType, 320 }; 321 322 const scored = scoreAudit(analysis); 323 324 return { 325 inputUrl: input.startUrl, 326 wellKnownUrl: wellKnownUrl.href, 327 https: analysis.https, 328 ok: true, 329 checkedAt: new Date().toISOString(), 330 httpStatus: fetched.status, 331 classification, 332 isRedirect, 333 isDirectServe, 334 redirectLocation: fetched.location, 335 redirectTargetUrl: redirectTargetUrl ? redirectTargetUrl.href : null, 336 redirectIsHttps, 337 sameOriginRedirect, 338 redirectTargetChecked: followRedirectTarget && isRedirect && classification === 'redirect', 339 redirectTargetReachable, 340 redirectTargetStatus, 341 redirectTargetError, 342 contentType: fetched.contentType, 343 score: scored.score, 344 grade: scored.grade, 345 issues: scored.issues, 346 recommendations: scored.recommendations, 347 error: null, 348 }; 349} 350 351function errorResult(inputUrl, errorMsg, wellKnownUrl) { 352 return { 353 inputUrl, 354 wellKnownUrl: wellKnownUrl || null, 355 https: null, 356 ok: false, 357 checkedAt: new Date().toISOString(), 358 httpStatus: null, 359 classification: 'unreachable', 360 isRedirect: false, 361 isDirectServe: false, 362 redirectLocation: null, 363 redirectTargetUrl: null, 364 redirectIsHttps: null, 365 sameOriginRedirect: null, 366 redirectTargetChecked: false, 367 redirectTargetReachable: null, 368 redirectTargetStatus: null, 369 redirectTargetError: null, 370 contentType: null, 371 score: 0, 372 grade: 'F', 373 issues: ['The request failed before the well-known path could be inspected. Verify the URL is reachable and try again.'], 374 recommendations: ['Verify the URL is public, reachable over HTTP/HTTPS, and returns a response.'], 375 error: errorMsg, 376 }; 377} 378 379/* --------------------------------------------------------------------------- 380 * Apify runtime entry point. 381 * ------------------------------------------------------------------------- */ 382 383const isExecutedDirectly = process.argv[1] && fileURLToPath(import.meta.url) === process.argv[1]; 384 385if (process.env.NODE_ENV !== 'test' && isExecutedDirectly) { 386 await Actor.init(); 387 try { 388 const input = await Actor.getInput(); 389 const result = await auditChangePasswordWellKnown(input || {}); 390 await Actor.pushData(result); 391 await Actor.setValue('OUTPUT', result); 392 Actor.log.info('Change-password well-known audit complete', { 393 classification: result.classification, 394 score: result.score, 395 grade: result.grade, 396 }); 397 } finally { 398 await Actor.exit(); 399 } 400}

{ "actorSpecification": 1, "name": "change-password-well-known-auditor", "title": "Change Password Well-Known URL Auditor", "description": "Audit a domain's /.well-known/change-password endpoint against the W3C/WHATWG Well-Known URL for Changing Passwords spec. Checks for a redirect to the real password-change page, verifies the target loads, and returns a readiness score, grade, issues, recommendations.", "version": "0.1", "buildTag": "latest", "meta": { "templateId": "js-start" }, "input": "./input_schema.json", "output": "./output_schema.json", "storages": { "dataset": "./dataset_schema.json" }, "dockerfile": "./Dockerfile", "defaultRunOptions": { "build": "latest", "timeoutSecs": 120, "memoryMbytes": 512 } }

{ "actorSpecification": 1, "views": { "overview": { "title": "Change-password well-known audits", "transformation": { "fields": [ "inputUrl", "wellKnownUrl", "ok", "classification", "isRedirect", "redirectLocation", "redirectTargetReachable", "score", "grade", "checkedAt", "error" ] }, "display": { "component": "table", "properties": { "inputUrl": { "label": "Input URL", "format": "link" }, "wellKnownUrl": { "label": "Well-known URL", "format": "link" }, "ok": { "label": "OK", "format": "boolean" }, "classification": { "label": "Classification" }, "isRedirect": { "label": "Is redirect", "format": "boolean" }, "redirectLocation": { "label": "Redirect Location" }, "redirectTargetReachable": { "label": "Target reachable", "format": "boolean" }, "score": { "label": "Score" }, "grade": { "label": "Grade" }, "checkedAt": { "label": "Checked at", "format": "date" }, "error": { "label": "Error" } } } } }, "fields": { "inputUrl": { "type": "string", "title": "Input URL" }, "wellKnownUrl": { "type": ["string", "null"], "title": "Well-known URL" }, "https": { "type": ["boolean", "null"], "title": "HTTPS" }, "ok": { "type": "boolean", "title": "OK" }, "checkedAt": { "type": "string", "title": "Checked at", "format": "date-time" }, "httpStatus": { "type": ["integer", "null"], "title": "HTTP status" }, "classification": { "type": "string", "title": "Classification" }, "isRedirect": { "type": "boolean", "title": "Is redirect" }, "isDirectServe": { "type": "boolean", "title": "Served directly (200) instead of redirecting" }, "redirectLocation": { "type": ["string", "null"], "title": "Raw redirect Location header" }, "redirectTargetUrl": { "type": ["string", "null"], "title": "Resolved redirect target URL" }, "redirectIsHttps": { "type": ["boolean", "null"], "title": "Redirect target is HTTPS" }, "sameOriginRedirect": { "type": ["boolean", "null"], "title": "Redirect target is same host" }, "redirectTargetChecked": { "type": "boolean", "title": "Redirect target fetch performed" }, "redirectTargetReachable": { "type": ["boolean", "null"], "title": "Redirect target returned a successful response" }, "redirectTargetStatus": { "type": ["integer", "null"], "title": "Redirect target HTTP status" }, "redirectTargetError": { "type": ["string", "null"], "title": "Redirect target fetch error" }, "contentType": { "type": ["string", "null"], "title": "Content-Type of the well-known response" }, "score": { "type": "integer", "title": "Score" }, "grade": { "type": "string", "title": "Grade" }, "issues": { "type": "array", "title": "Issues" }, "recommendations": { "type": "array", "title": "Recommendations" }, "error": { "type": ["string", "null"], "title": "Error" } } }

{ "title": "Change Password Well-Known URL Auditor input", "description": "Fetch one public domain or URL and audit its /.well-known/change-password endpoint against the W3C/WHATWG specification for a well-known URL for changing passwords. The actor requests the well-known path without following redirects automatically, classifies the response (redirect, direct-serve, not-found, unreachable), optionally verifies the redirect target page loads, and returns a readiness score, letter grade, issues, and recommendations. URLs with credentials and private network targets are rejected.", "type": "object", "schemaVersion": 1, "properties": { "startUrl": { "title": "Domain or URL", "type": "string", "description": "Public domain or URL to audit. Only the scheme and host are used; the actor always requests /.well-known/change-password on that host.", "editor": "textfield", "prefill": "https://example.com/" }, "timeoutSeconds": { "title": "Timeout seconds", "type": "integer", "description": "Request timeout from 3 to 30 seconds per request.", "editor": "number", "default": 10, "minimum": 3, "maximum": 30 }, "followRedirectTarget": { "title": "Verify redirect target loads", "type": "boolean", "description": "When the well-known URL redirects, also fetch the redirect target once to confirm it returns a successful response.", "editor": "checkbox", "default": true } }, "required": ["startUrl"] }

{ "actorOutputSchemaVersion": 1, "title": "Change Password Well-Known Audit Results", "properties": { "results": { "type": "string", "title": "Results", "template": "{{links.apiDefaultDatasetUrl}}/items" } } }

1import test from 'node:test'; 2import assert from 'node:assert/strict'; 3import { 4 classifyWellKnownResponse, 5 scoreAudit, 6 normalizeAndValidateUrl, 7 auditChangePasswordWellKnown, 8} from '../src/main.js'; 9 10/* --- classifyWellKnownResponse: classification ------------------------- */ 11 12test('classifyWellKnownResponse detects a valid redirect', () => { 13 const r = classifyWellKnownResponse({ ok: true, status: 301, location: 'https://example.com/account/password' }); 14 assert.equal(r.classification, 'redirect'); 15 assert.equal(r.isRedirect, true); 16 assert.equal(r.isDirectServe, false); 17}); 18 19test('classifyWellKnownResponse detects redirect missing Location', () => { 20 const r = classifyWellKnownResponse({ ok: true, status: 302, location: null }); 21 assert.equal(r.classification, 'redirect-missing-location'); 22 assert.equal(r.isRedirect, true); 23}); 24 25test('classifyWellKnownResponse detects not-found (404)', () => { 26 const r = classifyWellKnownResponse({ ok: true, status: 404, location: null }); 27 assert.equal(r.classification, 'not-found'); 28}); 29 30test('classifyWellKnownResponse detects not-found (410)', () => { 31 const r = classifyWellKnownResponse({ ok: true, status: 410, location: null }); 32 assert.equal(r.classification, 'not-found'); 33}); 34 35test('classifyWellKnownResponse detects direct-serve (200)', () => { 36 const r = classifyWellKnownResponse({ ok: true, status: 200, location: null }); 37 assert.equal(r.classification, 'direct-serve'); 38 assert.equal(r.isDirectServe, true); 39}); 40 41test('classifyWellKnownResponse detects unreachable', () => { 42 const r = classifyWellKnownResponse({ ok: false, status: null, location: null }); 43 assert.equal(r.classification, 'unreachable'); 44}); 45 46test('classifyWellKnownResponse detects unexpected status', () => { 47 const r = classifyWellKnownResponse({ ok: true, status: 500, location: null }); 48 assert.equal(r.classification, 'unexpected-status'); 49}); 50 51/* --- scoreAudit: scoring ------------------------------------------------ */ 52 53test('scoreAudit gives a high score for a clean HTTPS redirect with reachable target', () => { 54 const scored = scoreAudit({ 55 classification: 'redirect', 56 https: true, 57 sameOriginRedirect: true, 58 redirectIsHttps: true, 59 redirectTargetReachable: true, 60 redirectTargetStatus: 200, 61 contentType: null, 62 }); 63 assert.equal(scored.score, 85); 64 assert.equal(scored.grade, 'A'); 65 assert.equal(scored.issues.length, 0); 66}); 67 68test('scoreAudit fails hard for not-found', () => { 69 const scored = scoreAudit({ classification: 'not-found' }); 70 assert.equal(scored.score, 10); 71 assert.equal(scored.grade, 'F'); 72 assert.ok(scored.issues.some((i) => i.includes('No resource was found'))); 73}); 74 75test('scoreAudit fails hard for unreachable', () => { 76 const scored = scoreAudit({ classification: 'unreachable' }); 77 assert.equal(scored.score, 0); 78 assert.equal(scored.grade, 'F'); 79}); 80 81test('scoreAudit penalizes redirect to plain HTTP', () => { 82 const scored = scoreAudit({ 83 classification: 'redirect', 84 https: true, 85 sameOriginRedirect: true, 86 redirectIsHttps: false, 87 redirectTargetReachable: true, 88 redirectTargetStatus: 200, 89 contentType: null, 90 }); 91 assert.equal(scored.score, 65); 92 assert.ok(scored.issues.some((i) => i.includes('plain HTTP'))); 93}); 94 95test('scoreAudit penalizes unreachable redirect target', () => { 96 const scored = scoreAudit({ 97 classification: 'redirect', 98 https: true, 99 sameOriginRedirect: true, 100 redirectIsHttps: true, 101 redirectTargetReachable: false, 102 redirectTargetStatus: 500, 103 contentType: null, 104 }); 105 assert.equal(scored.score, 60); 106 assert.ok(scored.issues.some((i) => i.includes('did not return a successful response'))); 107}); 108 109test('scoreAudit gives partial credit for direct-serve (200) over HTTPS HTML', () => { 110 const scored = scoreAudit({ 111 classification: 'direct-serve', 112 https: true, 113 contentType: 'text/html; charset=utf-8', 114 }); 115 assert.equal(scored.score, 60); 116 assert.ok(scored.issues.some((i) => i.includes('deviates from the spec'))); 117}); 118 119test('scoreAudit penalizes direct-serve with non-HTML content type', () => { 120 const scored = scoreAudit({ 121 classification: 'direct-serve', 122 https: true, 123 contentType: 'application/json', 124 }); 125 assert.equal(scored.score, 50); 126}); 127 128test('scoreAudit flags cross-origin redirect without penalizing too harshly', () => { 129 const scored = scoreAudit({ 130 classification: 'redirect', 131 https: true, 132 sameOriginRedirect: false, 133 redirectIsHttps: true, 134 redirectTargetReachable: true, 135 redirectTargetStatus: 200, 136 contentType: null, 137 }); 138 assert.equal(scored.score, 75); 139 assert.ok(scored.issues.some((i) => i.includes('different host'))); 140}); 141 142test('scoreAudit never returns a score out of bounds', () => { 143 const scored = scoreAudit({ 144 classification: 'redirect', 145 https: false, 146 sameOriginRedirect: false, 147 redirectIsHttps: false, 148 redirectTargetReachable: false, 149 redirectTargetStatus: null, 150 contentType: null, 151 }); 152 assert.ok(scored.score >= 0 && scored.score <= 100); 153}); 154 155/* --- normalizeAndValidateUrl: SSRF boundaries --------------------------- */ 156 157test('normalizeAndValidateUrl rejects private IPv4 literals', async () => { 158 await assert.rejects(() => normalizeAndValidateUrl('http://192.168.1.1/'), /Private IPv4/); 159}); 160 161test('normalizeAndValidateUrl rejects localhost', async () => { 162 await assert.rejects(() => normalizeAndValidateUrl('http://localhost/'), /private/i); 163}); 164 165test('normalizeAndValidateUrl rejects loopback IP', async () => { 166 await assert.rejects(() => normalizeAndValidateUrl('http://127.0.0.1/'), /Private IPv4/); 167}); 168 169test('normalizeAndValidateUrl rejects URL credentials', async () => { 170 await assert.rejects(() => normalizeAndValidateUrl('https://user:pass@example.com/'), /credentials/i); 171}); 172 173test('normalizeAndValidateUrl rejects non-HTTP schemes', async () => { 174 await assert.rejects(() => normalizeAndValidateUrl('file:///etc/passwd'), /Only HTTP and HTTPS/); 175 await assert.rejects(() => normalizeAndValidateUrl('ftp://example.com/'), /Only HTTP and HTTPS/); 176}); 177 178test('normalizeAndValidateUrl rejects private IPv6 literals', async () => { 179 await assert.rejects(() => normalizeAndValidateUrl('http://[::1]/'), /Private IPv6/); 180 await assert.rejects(() => normalizeAndValidateUrl('http://[fd00::1]/'), /Private IPv6/); 181}); 182 183test('normalizeAndValidateUrl accepts a public https URL', async () => { 184 const url = await normalizeAndValidateUrl('https://example.com/'); 185 assert.equal(url.hostname, 'example.com'); 186}); 187 188test('normalizeAndValidateUrl prepends https scheme to bare hosts', async () => { 189 const url = await normalizeAndValidateUrl('example.com'); 190 assert.equal(url.protocol, 'https:'); 191}); 192 193test('normalizeAndValidateUrl rejects missing input', async () => { 194 await assert.rejects(() => normalizeAndValidateUrl(''), /required/i); 195 await assert.rejects(() => normalizeAndValidateUrl(null), /required/i); 196}); 197 198/* --- auditChangePasswordWellKnown: pipeline error paths ----------------- */ 199 200test('auditChangePasswordWellKnown returns a structured error for private IP input', async () => { 201 const result = await auditChangePasswordWellKnown({ startUrl: 'https://192.168.0.1/' }); 202 assert.equal(result.ok, false); 203 assert.equal(result.error !== null, true); 204 assert.equal(result.grade, 'F'); 205 assert.equal(result.classification, 'unreachable'); 206}); 207 208test('auditChangePasswordWellKnown returns a structured error for localhost input', async () => { 209 const result = await auditChangePasswordWellKnown({ startUrl: 'http://localhost/' }); 210 assert.equal(result.ok, false); 211 assert.equal(result.error !== null, true); 212}); 213 214test('auditChangePasswordWellKnown returns a structured error for unreachable host', async () => { 215 const result = await auditChangePasswordWellKnown({ 216 startUrl: 'https://change-password-auditor-nonexistent-invalid.example/', 217 timeoutSeconds: 3, 218 }); 219 assert.equal(result.ok, false); 220 assert.equal(result.error !== null, true); 221 assert.equal(result.grade, 'F'); 222}); 223 224/* --- auditChangePasswordWellKnown: live public smoke -------------------- */ 225 226test('auditChangePasswordWellKnown smoke: github.com redirects to a password settings page', async () => { 227 const result = await auditChangePasswordWellKnown({ startUrl: 'https://github.com/', timeoutSeconds: 15 }); 228 // Tolerate network flakiness: only assert when the fetch itself worked. 229 if (result.ok) { 230 assert.equal(result.classification, 'redirect'); 231 assert.equal(result.isRedirect, true); 232 assert.ok(result.redirectLocation); 233 assert.equal(typeof result.score, 'number'); 234 assert.ok(result.score >= 60); 235 } else { 236 assert.ok(result.error, 'failed smoke must carry an error message'); 237 } 238}); 239 240test('auditChangePasswordWellKnown smoke: a domain without the well-known path reports not-found', async () => { 241 const result = await auditChangePasswordWellKnown({ startUrl: 'https://www.google.com/', timeoutSeconds: 15 }); 242 if (result.ok) { 243 assert.equal(result.inputUrl, 'https://www.google.com/'); 244 assert.equal(typeof result.score, 'number'); 245 assert.equal(Array.isArray(result.issues), true); 246 assert.equal(Array.isArray(result.recommendations), true); 247 assert.equal(result.checkedAt.includes('T'), true); 248 // google.com does not implement this well-known path at time of writing 249 if (result.httpStatus === 404) { 250 assert.equal(result.classification, 'not-found'); 251 } 252 } else { 253 assert.ok(result.error, 'failed smoke must carry an error message'); 254 } 255});