Every step, every parameter.
AuthTailor has five tabs1. This page lists what is in each – with a source for every claim. What we check, we check in ourselves, too.
Record, paste, check, rate.
Press “Record live” and sign in in any tab2: the flow browser → app → identity provider appears as a diagram, every step with its parameters.
- Check the whole flow.state, nonce, PKCE, redirect_uri, InResponseTo, ACS URL and RelayState – not per message, but across the whole flow.
- Paste anything.SAML Response, AuthnRequest, Assertion, metadata, JWT, login URL, token request and response, discovery, JWKS, HAR file or the error message3; known error codes with cause and fix.
- See the token.Header, payload and signature, the chain from issuer to audience, an ID card with scopes and roles4, times relative to now.
- Signatures really checked.SAML with the certificate and the fingerprint from the metadata, JWTs with the issuer’s keys5; warnings about expiring certificates and keys missing after a rollover.
- Headers per step.Request and response headers, masked, with a SameSite check6 of the cookies on the POST back to the app.
- Bearer tokens and DPoP.Optionally the JWTs a single-page app sends to its API7, with the rejection reason from WWW-Authenticate and checked DPoP proofs.
- Attack patterns and leaks.Signature wrapping, a comment in the NameID, jku/x5u in the JWT header, codes in the Referer, tokens in the URL8, session fixation, open redirects.
- Logout, discovery, metadata.Whether the session really ends at logout9, and what discovery and metadata reveal about security.
- Traffic light and report.Five areas rated separately10; the Markdown report11 goes into the ticket masked.
Everything that goes wrong around the login.
Paste, and the tab detects what it is12: passkey response, certificate, key, policy or link.
- Passkeys.Decode a WebAuthn response: flags, authenticator, synced or device-bound, origin, RP ID and challenge checked.
- Certificates and keys.PEM chains, CSRs, public and private keys, JWKs – order, expiry, key size, SHA-1, host name, and whether key and certificate belong together.
- Web security.Content Security Policy with a stricter suggestion, security headers of a login page, CORS preflight, look-alike and punycode links, open redirects.
- Secrets and HAR.A secret scanner for any text and a HAR cleaner13 that masks cookies, tokens, codes and passwords and saves a .sanitized.har file.
- Page storage.On click, find tokens in localStorage, sessionStorage and IndexedDB of the current tab14 – only kind and length come back, never a value.
SAP BTP: tokens, configuration, flows.
For everyone working with XSUAA, SAP Cloud Identity Services and destinations – and wondering why the app says 403.
- XSUAA and IAS tokens.Scopes per app, role collections, zone and grant15, explained rather than just decoded.
- “Why 403?”Paste the token, enter the expected scopes or roles – scope by scope, what is missing16.
- Configuration reviewed.xs-security.json, xs-app.json, service keys and destinations (JSON or properties); secrets appear masked only and stay in memory.
- Flows as diagrams.App router → XSUAA → IAS, IAS directly, principal propagation, SAML bearer and CSRF – plus logon tickets (MYSAPSSO2) with signature check and SAP Gateway and ICF errors.
Understand what you are looking at.
13 flows of OAuth 2.0, OpenID Connect and SAML17 as sequence diagrams to click through and play, with risks and what the tracer checks.
- Flows.Code + PKCE, BFF, client credentials, refresh, device code, on-behalf-of, DPoP, implicit, password grant, SAML SP- and IdP-initiated, SAML bearer, logout.
- Basics.Eight short chapters – from protocols and tokens to keys and certificates, cookies, logout and tokens in the browser.
- Glossary and error catalogue.Terms in one sentence and known error messages with cause and fix.
- Go-live checklist.What should be checked before the first production login.
What the extension does – inside the extension.
The “About” tab shows what AuthTailor does, the full privacy policy, the permissions with their current state18, what is stored (with a reset), the publisher with imprint, version and build.
Sources on this page
The superscript numbers in the text point here. Tap one to see the source right where it is used; all sources of this website are listed on one page.
- 1
Five tabs ↑Product · AuthTailor product documentation, README and changelog 1.0.0 · checked on 2026-11-08
- 2
Record live in any tab ↑Product · AuthTailor product documentation, README, Auth Trace · checked on 2026-11-08
- 3
Paste or drop ↑Product · AuthTailor product documentation, README, Auth Trace · checked on 2026-11-08
- 4
Visual anatomy of JWT and SAML ↑Product · AuthTailor product documentation, README, Auth Trace · checked on 2026-11-08
- 5
Signatures really checked ↑Product · AuthTailor product documentation, README and changelog 1.0.0 · checked on 2026-11-08
- 6
Headers per step, masked ↑Product · AuthTailor product documentation, README, Auth Trace · checked on 2026-11-08
- 7
Bearer tokens and DPoP (option) ↑Product · AuthTailor product documentation, README, Auth Trace · checked on 2026-11-08
- 8
Attack patterns and leaks ↑Product · AuthTailor product documentation, README and changelog 1.0.0 · checked on 2026-11-08
- 9
Logout, discovery and metadata ↑Product · AuthTailor product documentation, changelog 1.0.0 · checked on 2026-11-08
- 10
Traffic light in five areas ↑Product · AuthTailor product documentation, changelog 1.0.0, security check · checked on 2026-11-08
- 11
Markdown report, masked ↑Product · AuthTailor product documentation, README, Auth Trace · checked on 2026-11-08
- 12
Tools: passkeys, certificates, web security ↑Product · AuthTailor product documentation, README and changelog 1.0.0, Tools · checked on 2026-11-08
- 13
Clean a HAR file ↑Product · AuthTailor product documentation, changelog 1.0.0, Tools · checked on 2026-11-08
- 14
Find tokens in page storage – without the value ↑Product · AuthTailor product documentation, README, permissions; changelog 1.0.0 · checked on 2026-11-08
- 15
SAP BTP: tokens, configuration, flows ↑Product · AuthTailor product documentation, README and changelog 1.0.0, SAP · checked on 2026-11-08
- 16
“Why 403?” ↑Product · AuthTailor product documentation, changelog 1.0.0, SAP · checked on 2026-11-08
- 17
13 flows, eight chapters, glossary, error catalogue, checklist ↑Product · AuthTailor product documentation, README and changelog 1.0.0, Learning · checked on 2026-11-08
- 18
Permissions and host access ↑Product · AuthTailor product documentation, README, “Privacy and permissions”; Chrome Web Store materials · checked on 2026-11-08
Questions about the features.
- Which protocols does AuthTailor understand?
- SAML 2.0 (Response, AuthnRequest, Assertion, metadata, logout) and OpenID Connect with OAuth 2.0 (authorisation, token request and response, discovery, JWKS, refresh, DPoP, logout). Plus passkey responses (WebAuthn) under Tools.
- Do I have to record, or can I paste something?
- Both. Without a recording you paste what you have: a SAML Response, a JWT, a login URL, a HAR file from the developer tools or the error message. The tracer detects what it is.
- Does AuthTailor really check signatures or just show them?
- It checks them: SAML cryptographically with the certificate from the message, optionally matched against the fingerprint from the metadata; JWTs with the issuer’s public keys, fetched with one click.
- Can I hand the result to colleagues or support?
- Yes, as a Markdown report with verdict, traffic light, flows, findings and steps – with masked values only. The extension cleans HAR files before you pass them on.
Your question isn’t here? Talk to me: +43 664 1964199 office@clouddna.at Get in touch