You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
Proposal: enforce single-use semantics for back-channel logout tokens (#51218)
#52260
I would like to work on #51218 and add replay protection for OIDC
back-channel logout tokens.
Before implementing it, I would like to confirm the expected semantics:
Should a replayed logout_token return 400 invalid_request, or should it
be treated as a successful no-op?
Should the jti be reserved atomically through
session.singleUseObjects().putIfAbsent(...) after cryptographic and
claim validation, but before logout side effects?
What lifespan should be used when storing the jti, especially if exp
is absent: a fixed replay window or a provider-derived value?
If local or downstream logout fails, should the jti remain consumed?
I plan to add integration coverage in BackchannelLogoutTest for both
sequential and concurrent replay of the same token.
reacted with thumbs up emoji reacted with thumbs down emoji reacted with laugh emoji reacted with hooray emoji reacted with confused emoji reacted with heart emoji reacted with rocket emoji reacted with eyes emoji
Uh oh!
There was an error while loading. Please reload this page.
I would like to work on #51218 and add replay protection for OIDC
back-channel logout tokens.
Before implementing it, I would like to confirm the expected semantics:
be treated as a successful no-op?
session.singleUseObjects().putIfAbsent(...) after cryptographic and
claim validation, but before logout side effects?
is absent: a fixed replay window or a provider-derived value?
I plan to add integration coverage in BackchannelLogoutTest for both
sequential and concurrent replay of the same token.
All reactions