<html><head><meta http-equiv="Content-Type" content="text/html charset=windows-1252"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">It might be used as a denial of service via xsrf.<div class=""><br class=""></div><div class="">I originally wanted to make the id_token_hint required to prevent that sort of thing from working. </div><div class="">That was softened to a RECOMMENDED in the Session Management spec. </div><div class=""><br class=""></div><div class="">I suspect a compromise might be for the IdP to prompt the user if the request doesn’t contain a valid id_token_hint.</div><div class=""><br class=""></div><div class="">John B.</div><div class=""><br class=""></div><div class=""><div><blockquote type="cite" class=""><div class="">On Feb 15, 2015, at 1:08 PM, Torsten Lodderstedt <<a href="mailto:torsten@lodderstedt.net" class="">torsten@lodderstedt.net</a>> wrote:</div><br class="Apple-interchange-newline"><div class="">
<meta content="text/html; charset=windows-1252" http-equiv="Content-Type" class="">
<div bgcolor="#FFFFFF" text="#000000" class="">
Hi,<br class="">
<br class="">
why do you consider this a risk? <br class="">
<br class="">
kind regards,<br class="">
Torsten.<br class="">
<br class="">
<div class="moz-cite-prefix">Am 14.02.2015 um 10:05 schrieb Thomas
Broyer:<br class="">
</div>
<blockquote cite="mid:CAEayHEOnsY+46gFSce64JXKsfE=DNC6cWgURKktibeRenzSgZg@mail.gmail.com" type="cite" class=""><p dir="ltr" class="">Hi,</p><p dir="ltr" class="">Isn't there a risk of an attacker logging a user out
of a third-party (victim) site just by loading that logout_url?
At a minimum the RP should check the request's origin or
referrer but AFAIK this wouldn't be reliable with such
cross-origin requests (at least for older browsers not sending
an Origin header), but maybe the OP could compute some value
based on a shared secret, or use a signed JWT, and pass it as a
query string parameter to "authenticate" the request?<br class="">
</p><p dir="ltr" class="">Le sam. 14 févr. 2015 07:12, Mike Jones <<a moz-do-not-send="true" href="mailto:Michael.Jones@microsoft.com" class="">Michael.Jones@microsoft.com</a>>
a écrit :</p>
<br class="">
<fieldset class="mimeAttachmentHeader"></fieldset>
<br class="">
<pre wrap="" class="">_______________________________________________
Openid-specs-ab mailing list
<a class="moz-txt-link-abbreviated" href="mailto:Openid-specs-ab@lists.openid.net">Openid-specs-ab@lists.openid.net</a>
<a class="moz-txt-link-freetext" href="http://lists.openid.net/mailman/listinfo/openid-specs-ab">http://lists.openid.net/mailman/listinfo/openid-specs-ab</a>
</pre>
</blockquote>
<br class="">
</div>
_______________________________________________<br class="">Openid-specs-ab mailing list<br class=""><a href="mailto:Openid-specs-ab@lists.openid.net" class="">Openid-specs-ab@lists.openid.net</a><br class="">http://lists.openid.net/mailman/listinfo/openid-specs-ab<br class=""></div></blockquote></div><br class=""></div></body></html>