Acquires an Access Token using Resource Owner Password credentials, then uses it to call the UserInfo endpoint.

Acquires tokens, performs a refresh_token grant to get a new pair, and verifies the new access token is valid.

Repeatedly sends invalid credentials to trigger the Threat Protection lockout, verifying that the final attempt is blocked with a 429 or 403.

Authenticates against Tenant A, then attempts to use that token on Tenant B's UserInfo endpoint, expecting a 401/403.

Acquires a token pair, revokes the refresh token via /connect/revocation, then verifies it can no longer be used for refresh.

Attempts an authorization request with an unregistered/tampered Redirect URI. Expects HTTP 400 or a safe error page.

Attempts to exchange an invalid or previously reused authorization code. Expects HTTP 400 to ensure strict token boundary handling.

Acquires a valid Access Token, maliciously modifies its JWT signature, and submits it to /userinfo. Expects HTTP 401.

Submits up to 10 sequential invalid login requests to confirm backend rate limiting triggers (HTTP 429/403).

Injects spoofed X-Forwarded-For headers to verify the backend safely processes them without crashing or blind trust.

Spawns 10 parallel auth requests to verify the endpoint remains stable (no 500s) under concurrent load.

Attempts an authorization request over insecure HTTP. Expects a redirect to HTTPS when SslRequirement is enabled.