hub · compare

/.well-known/oauth-protected-resource

RFC 9728 Protected Resource Metadata; resource matches the served URL, authorization_servers resolves on this host, bearer methods are IANA-registered

chaos chaos.catastrophic.io

GET /.well-known/oauth-protected-resource

RFC 9728 Protected Resource Metadata for the OAuth client-server chaos quartet. Default mode joins the conflicting-discovery group with an issuer that disagrees with the OIDC and AS documents; other modes exercise resource-server-specific flaws (unreachable AS, unregistered bearer methods, mismatched resource identifier).

modes: mismatched-issuer unreachable-as invalid-bearer-methods mismatched-resource-id

full chaos docs →

control not.catastrophic.io

GET /.well-known/oauth-protected-resource

RFC 9728 Protected Resource Metadata; resource matches the served URL, authorization_servers resolves on this host, bearer methods are IANA-registered

full control docs →

Build against not.catastrophic.io/.well-known/oauth-protected-resource, then flip the hostname to chaos.catastrophic.io to exercise the chaos.