Changelog

Not yet released

• SAP App Router: for a login via an SAP App Router (such as Integration Suite or Build Work Zone) the tracer reports SAP App Router: the token stays on the server under Across the flow – with subaccount, region, XSUAA client, trust (origin) and IdP. Missing state and PKCE are only notes there; other apps keep the warning. See SAP.
• SAP ID Service and OIDC between the IdPs: if the BTP login used the default trust sap.default instead of your own IAS, the tracer says so – with the way to your own IdP. It names legs via OIDC (XSUAA → IAS, IAS → corporate IdP) and points to the IAS Troubleshooting Logs and the corporate IdP’s sign-in logs. See SAP.
• Website: the link in the store and in the extension points to authtailor.com. The extension’s privacy policy is under Privacy – the same text as under About.

1.0.0 – 8 November 2026

First release in the Chrome Web Store. Edge installs the extension from the same listing; for Firefox (115 or later) there is a package on request.

Auth Trace

• Live capture of a login in the browser, host access only while recording; optionally bearer JWTs from API calls and headers per step, masked. See Live capture.
• Paste or drop SAML, JWTs, OAuth and OIDC URLs, token requests and responses, discovery, JWKS, HAR and error messages. See Paste and examples.
• Verdict, traffic light in five areas, flow diagram browser – app – IdP with cross-checks and a Markdown report. See Reading the result.
• Signatures really checked: SAML with our own XML canonicalisation, RSA, RSA-PSS and ECDSA with SHA-1 to SHA-512; JWTs with the issuer’s keys. Visual anatomy for JWT and SAML. See Tokens and SAML.
• Attack patterns and leaks: signature wrapping, duplicate IDs, comment in the NameID, DTD and transforms; jku, x5u and jwk in the header, kid injection; code or token in the Referer, tokens in the query, client secret from the browser; session fixation, scripts without SRI, open redirects, look-alike and punycode hosts.
• Logout, discovery and metadata rated; DPoP proofs and refresh token rotation checked.

Tools, SAP, Learning, About

• Tools: check passkeys, certificates, keys, CSP, security headers, CORS, login links and scan for secrets; clean a HAR; scan page storage. See Tools.
• SAP: XSUAA and IAS tokens, “Why 403?”, reviews of xs-security.json and xs-app.json, service keys, destinations and logon tickets; five BTP flows and six chapters. See SAP.
• Learning: 13 flows as sequence diagrams, basics in chapters, glossary, error catalogue and go-live checklist. See Learning.
• About: what AuthTailor does, privacy, permissions with the state of host access, stored settings and the full privacy policy. See Permissions and privacy.
• UI in English and German, light and dark following the system.

Fixed

• Deleted cookies are no longer reported as “SameSite=None without Secure”.