<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">A question has arisen based on differences observed in multiple implementations.<div class=""><br class=""></div><div class="">When executing front channel logout per the session management spec it is unclear what the response should be if “id_token_hint” contains an expired token. The processing rules allow you to ignore audience but they say nothing about an expired token.</div><div class=""><br class=""></div><div class=""><dt style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0); font-family: verdana, charcoal, helvetica, arial, sans-serif;" class="">id_token_hint</dt><dd style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0); font-family: verdana, charcoal, helvetica, arial, sans-serif;" class="">RECOMMENDED. Previously issued ID Token passed to the logout endpoint as a hint about the End-User's current authenticated session with the Client. This is used as an indication of the identity of the End-User that the RP is requesting be logged out by the OP. The OP need not be listed as an audience of the ID Token when it is used as an <tt style="color: rgb(0, 51, 102); font-family: "Courier New", Courier, monospace; font-size: small;" class="">id_token_hint</tt> value.</dd><div class=""><br class=""></div></div><div class="">Section 6 says…</div><div class=""><span style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0); font-family: verdana, charcoal, helvetica, arial, sans-serif; font-size: small; background-color: rgb(255, 255, 255);" class="">"If any of the validation procedures defined in this specification fail, any operations requiring the information that failed to correctly validate MUST be aborted and the information that failed to validate MUST NOT be used."</span></div><div class=""><span style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0); font-family: verdana, charcoal, helvetica, arial, sans-serif; font-size: small; background-color: rgb(255, 255, 255);" class=""><br class=""></span></div><div class=""><span style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0); font-family: verdana, charcoal, helvetica, arial, sans-serif; font-size: small; background-color: rgb(255, 255, 255);" class="">The problem is, the spec never calls for the token to be validated but it does say you can skip the audience.</span></div><div class=""><span style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0); font-family: verdana, charcoal, helvetica, arial, sans-serif; font-size: small; background-color: rgb(255, 255, 255);" class=""><br class=""></span></div><div class=""><span style="background-color: rgb(255, 255, 255);" class=""><font color="#000000" face="verdana, charcoal, helvetica, arial, sans-serif" size="2" class=""><span style="caret-color: rgb(0, 0, 0);" class="">In this case what is the correct response? It seems like an error should be returned. Though killing an expired session doesn’t seem like much more than a no-op. It seems like this would provide better UX.</span></font></span></div><div class=""><span style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0); font-family: verdana, charcoal, helvetica, arial, sans-serif; font-size: small; background-color: rgb(255, 255, 255);" class=""><br class=""></span></div><div class=""><span style="background-color: rgb(255, 255, 255);" class=""><font color="#000000" face="verdana, charcoal, helvetica, arial, sans-serif" size="2" class="">The concern is that if accepted it might be used as a DoS attack to cause the redirect url to be invoked when it shouldn’t.</font></span></div><div class=""><span style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0); font-family: verdana, charcoal, helvetica, arial, sans-serif; font-size: small; background-color: rgb(255, 255, 255);" class=""><br class=""></span></div><div class=""><div class="">
<div dir="auto" style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0); letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><div dir="auto" style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0); letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><div dir="auto" style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0); letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><div dir="auto" style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0); letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><div dir="auto" style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0); letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><div dir="auto" style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><div style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;">Phil Hunt | OCI IDCS Cloud Identity & Security Architect</div><div style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;">Oracle Corporation, Oracle Cloud Infrastructure</div><div style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;">@independentid</div><div style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"><a href="http://www.independentid.com" class="">www.independentid.com</a></div><div style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"><a href="mailto:phil.hunt@oracle.com" class="">phil.hunt@oracle.com</a></div><div style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;" class=""><br class=""></div><br class="Apple-interchange-newline"></div></div><br class="Apple-interchange-newline"></div><br class="Apple-interchange-newline"></div><br class="Apple-interchange-newline"></div><br class="Apple-interchange-newline"></div><br class="Apple-interchange-newline"><br class="Apple-interchange-newline">
</div>
<br class=""></div></body></html>