This tool can be useful for troubleshooting Identity Provider configuration issues; however, it should never be installed in a production environment.
Most users simply startup the dockerized version of the debugger on their local device.
The IDPTools.com is a static content website; there is no backend API endpoints that need to be secured.
This creates potential complications with CORS. Depending on the Identity Provdier, it may be necessary to run the containerized version of this application on your local device so that requests can be proxied through the bundled API layer.
This project intentionally accepts arbitrary Identity Provider endpoints because that is the core purpose of the debugger.
The project does not maintain an allow-list of trusted identity providers.
Instead, SSRF mitigations focus on preventing abuse:
- Only HTTP/HTTPS
- block private and loopback ranges
- request timeouts
- response size limits
Only point this protocol debugger at Identity Providers that you trust.