Error Handling Test Case Reviewer
Review test cases for error handling in OpenID Connect Basic OP.
Scope
- Feature: Error Responses
- Specifications: OAuth 2.1 Section 4.1.2.1, 5.2; OIDC Core 1.0 Section 3.1.2.6
- Profile: Basic OP (Authorization Code Flow)
Review Process
- Identify which error scenario the test targets
- Check against the checklist below
- Verify correct error code is returned
- Ensure response format matches specification
- Report gaps with specific spec section references
Authorization Endpoint Errors
OAuth 2.1 Error Codes (Section 4.1.2.1)
| Error Code | Condition | Spec |
|---|
invalid_request
| Missing/malformed parameter, duplicate parameter | OAuth 2.1 4.1.2.1 |
unauthorized_client
| Client not authorized for grant type | OAuth 2.1 4.1.2.1 |
access_denied
| Resource owner or AS denied request | OAuth 2.1 4.1.2.1 |
unsupported_response_type
| response_type not supported | OAuth 2.1 4.1.2.1 |
invalid_scope
| Invalid, unknown, or malformed scope | OAuth 2.1 4.1.2.1 |
server_error
| Unexpected condition (use sparingly) | OAuth 2.1 4.1.2.1 |
temporarily_unavailable
| Server temporarily overloaded | OAuth 2.1 4.1.2.1 |
OIDC-Specific Error Codes (Section 3.1.2.6)
| Error Code | Condition | Spec |
|---|
interaction_required
| prompt=none but End-User interaction needed | OIDC Core 3.1.2.6 |
login_required
| prompt=none but End-User not authenticated | OIDC Core 3.1.2.6 |
account_selection_required
| prompt=none but account selection needed | OIDC Core 3.1.2.6 |
consent_required
| prompt=none but consent required | OIDC Core 3.1.2.6 |
invalid_request_uri
| request_uri invalid or unreachable | OIDC Core 3.1.2.6 |
invalid_request_object
| Request Object invalid | OIDC Core 3.1.2.6 |
request_not_supported
| OP doesn't support request parameter | OIDC Core 3.1.2.6 |
request_uri_not_supported
| OP doesn't support request_uri parameter | OIDC Core 3.1.2.6 |
registration_not_supported
| OP doesn't support registration parameter | OIDC Core 3.1.2.6 |
Authorization Error Response Format
For Authorization Code flow, errors returned in query component:
HTTP/1.1 302 Found
Location: https://client.example.org/cb?
error=invalid_request
&error_description=Unsupported%20response_type%20value
&state=af0ifjsldkj
Token Endpoint Errors
OAuth 2.1 Error Codes (Section 5.2)
| Error Code | Condition | Spec |
|---|
invalid_request
| Missing/malformed parameter | OAuth 2.1 5.2 |
invalid_client
| Client authentication failed | OAuth 2.1 5.2 |
invalid_grant
| Invalid/expired code, redirect_uri mismatch, PKCE failure | OAuth 2.1 5.2 |
unauthorized_client
| Client not authorized for grant type | OAuth 2.1 5.2 |
unsupported_grant_type
| grant_type not supported | OAuth 2.1 5.2 |
invalid_scope
| Requested scope exceeds grant | OAuth 2.1 5.2 |
Token Error Response Format
Errors returned as JSON with HTTP 400 (or 401 for invalid_client):
HTTP/1.1 400 Bad Request
Content-Type: application/json;charset=UTF-8
Cache-Control: no-store
{
"error": "invalid_grant",
"error_description": "Authorization code expired"
}
HTTP Status Codes
| Error | HTTP Status |
|---|
invalid_client
| 401 (if via Authorization header) or 400 |
| All others | 400 |
Error Response Parameters
| Parameter | Required | Description |
|---|
error
| REQUIRED | ASCII error code |
error_description
| OPTIONAL | Human-readable description (ASCII) |
error_uri
| OPTIONAL | URI with error information |
state
| REQUIRED if in request | Exact value from request |
Test Cases Checklist
Missing Required Parameters
| Scenario | Expected Error | Endpoint |
|---|
| [ ] Missing response_type | invalid_request
| Authorization |
| [ ] Missing client_id | invalid_request
| Authorization |
| [ ] Missing scope | invalid_request
| Authorization |
| [ ] Missing openid in scope | invalid_scope
| Authorization |
| [ ] Missing grant_type | invalid_request
| Token |
| [ ] Missing code | invalid_request
| Token |
| [ ] Missing code_verifier (when required) | invalid_grant
| Token |
Invalid Parameters
| Scenario | Expected Error | Endpoint |
|---|
| [ ] Unknown response_type | unsupported_response_type
| Authorization |
| [ ] Unregistered redirect_uri | invalid_request
| Authorization |
| [ ] Invalid redirect_uri format | invalid_request
| Authorization |
| [ ] Invalid client_id | unauthorized_client
or invalid_request
| Authorization |
| [ ] Invalid/expired code | invalid_grant
| Token |
| [ ] Code already used | invalid_grant
| Token |
| [ ] PKCE verification failure | invalid_grant
| Token |
| [ ] Client authentication failure | invalid_client
| Token |
prompt=none Specific Errors
| Scenario | Expected Error |
|---|
| [ ] User not authenticated | login_required
|
| [ ] Consent not yet given | consent_required
|
| [ ] Multiple accounts, selection needed | account_selection_required
|
| [ ] Any interaction needed | interaction_required
|
Redirect URI Edge Cases
| Scenario | Expected Behavior |
|---|
| [ ] Invalid/unregistered redirect_uri | MUST NOT redirect, display error |
| [ ] Valid redirect_uri but error occurred | Redirect with error in query |
| [ ] Error with state in request | Include state in error response |
Error Response Validation Checklist
| Check | Requirement |
|---|
[ ] error
parameter present | |
[ ] error
value is valid code | |
[ ] state
returned if sent | |
| [ ] No redirect for invalid redirect_uri | |
| [ ] Correct HTTP status code | |
| [ ] JSON Content-Type for token endpoint | |
| [ ] No caching headers (Cache-Control: no-store) | |
Conformance Test IDs
| Test ID | Scenario |
|---|
| OP-Response-Missing | Missing response_type → error |
| OP-redirect_uri-NotReg | Unregistered redirect_uri → error |
| OP-OAuth-2nd | Reused code → error |
| OP-OAuth-2nd-30s | Code reuse after 30s → error |
Review Output Format
## Test Case: [Name]
### Target Feature: Error Handling - [specific scenario]
### Test ID: OP-Error-[xxx]
### Spec Compliance:
- [x] Covers required behavior per [spec section]
- [ ] Missing: [specific requirement]
### Error Response:
- [x/blank] Correct error code
- [x/blank] Correct HTTP status
- [x/blank] state included if sent
### Verdict: PASS / FAIL / PARTIAL
### Recommendations: [if any]
