Remediation
`/.well-known/oauth-authorization-server` is reachable and conforms to RFC 8414, letting agents discover authorization endpoints without out-of-band setup.
discoverability.oauth_authorization_serverdiscoverabilityweight 1deterministic
Why it matters
`/.well-known/oauth-authorization-server` is reachable and conforms to RFC 8414, letting agents discover authorization endpoints without out-of-band setup.
Underlying specification: https://datatracker.ietf.org/doc/html/rfc8414
How to fix
- See the full check definition in the rubric (linked above) for the canonical reference.
- Read the underlying specification at https://datatracker.ietf.org/doc/html/rfc8414.
Run a scan to check your site
Verify on your site
Run a scan against your domain to see whether discoverability.oauth_authorization_server currently passes, warns, or fails. Free, no signup; the score page is permanent and citable.