Authorization Code Reuse Test Partial Result about oidctest

[rohe]

The problem is that you're returning a 403.
If RFC 6749 says anything about HTTP error codes it is that it should be a 400.
For some reason OIDC core has added 401 just for Userinfo responses.
No one mentions 403.
I have OPs returning a 200 with an error message you're the first returning a 403 :-)
I can make the tool also accept 403 but it will take a while.

[selfissued]

We should issue a warning if the status code is not the expected one.

[selfissued]

A warning should be issued if it's not a 401 (or possibly a 400). The use of 403 is wrong, and should result in a warning.

[aeneasr]

This took me some while to figure out, it would be great if the test tool showed a warning or potentially fail if 403 was issued.

[zandbelt]

that's rolled out now on production (and test) as part of release 2.2.0