[Openid-specs-ab] Possible "error" state return from OP i-frame in session management
Michael.Jones at microsoft.com
Thu Jul 31 19:24:13 UTC 2014
Currently, session management allows only two return values from the OP postMessage - "changed" and "unchanged". Implementers have asked me what they should do if the RP's postMessage is malformed. For instance, what if it is not of the required format below?
Client ID + " " + Session State
At first, I thought that such inputs should result in a "changed" return, but the problem with this is that it could cause an infinite loop of prompt=none requests to the server - a bad thing.
I'm increasingly thinking that an "error" return should be added for responding to malformed requests and that guidance should be given that "error" returns should be handed by the RP in a way that will not cause a potential infinite loop of prompt=none requests.
What do others think?
-------------- next part --------------
An HTML attachment was scrubbed...
More information about the Openid-specs-ab