[Openid-specs-ab] Issue #930: Session 4.2 - Define "error" return from OP iframe for syntax errors (openid/connect)

Michael Jones issues-reply at bitbucket.org
Tue Aug 5 01:03:30 UTC 2014


New issue 930: Session 4.2 - Define "error" return from OP iframe for syntax errors
https://bitbucket.org/openid/connect/issue/930/session-42-define-error-return-from-op

Michael Jones:

Currently, session management allows only two return values from the OP postMessage – “changed” and “unchanged”.  Implementers have asked me what they should do if the RP’s postMessage is malformed.  For instance, what if it is not of the required format below?
               Client ID + " " + Session State

At first, I thought that such inputs should result in a “changed” return, but the problem with this is that it could cause an infinite loop of prompt=none requests to the server – a bad thing.

I’m increasingly thinking that an “error” return should be added for responding to malformed requests and that guidance should be given that “error” returns should be handed by the RP in a way that will not cause a potential infinite loop of prompt=none requests.





More information about the Openid-specs-ab mailing list