Consider OIDC Back-Channel favoring logout_token over CSRF #13841
Assignees
Labels
in: oauth2
An issue in OAuth2 modules (oauth2-core, oauth2-client, oauth2-resource-server, oauth2-jose)
type: enhancement
A general enhancement
Milestone
Comments
jzheaux
added
status: waiting-for-triage
jzheaux
added
in: oauth2
jzheaux
added
the
status: blocked
|
Waiting on #14510 |
jzheaux
removed
the
status: blocked
jzheaux
added a commit
to jzheaux/spring-security
that referenced
this issue
Aug 8, 2024
jzheaux
added a commit
to jzheaux/spring-security
that referenced
this issue
Aug 8, 2024
jzheaux
added a commit
to jzheaux/spring-security
that referenced
this issue
Aug 8, 2024
jzheaux
added a commit
to jzheaux/spring-security
that referenced
this issue
Aug 8, 2024
jzheaux
added a commit
to jzheaux/spring-security
that referenced
this issue
Sep 4, 2024
jzheaux
added a commit
to jzheaux/spring-security
that referenced
this issue
Sep 4, 2024
jzheaux
added a commit
to jzheaux/spring-security
that referenced
this issue
Sep 4, 2024
jzheaux
added a commit
to jzheaux/spring-security
that referenced
this issue
Sep 4, 2024
jzheaux
added a commit
to jzheaux/spring-security
that referenced
this issue
Sep 4, 2024
jzheaux
added a commit
to jzheaux/spring-security
that referenced
this issue
Sep 4, 2024
jzheaux
added a commit
to jzheaux/spring-security
that referenced
this issue
Sep 4, 2024
jzheaux
added a commit
to jzheaux/spring-security
that referenced
this issue
Sep 4, 2024
jzheaux
added a commit
to jzheaux/spring-security
that referenced
this issue
Sep 4, 2024
jzheaux
added a commit
to jzheaux/spring-security
that referenced
this issue
Sep 4, 2024
jzheaux
added a commit
to jzheaux/spring-security
that referenced
this issue
Sep 4, 2024
jzheaux
added a commit
to jzheaux/spring-security
that referenced
this issue
Sep 16, 2024
This component already uses by default a URI that doesn't require a CSRF token and aalready allows for configuring a cookie name. So, by making it public and configurable in the DSL, both of these tickets quite naturally close. Closes spring-projectsgh-13841 Closes spring-projectsgh-14904
jzheaux
added a commit
to jzheaux/spring-security
that referenced
this issue
Sep 16, 2024
This component already uses by default a URI that doesn't require a CSRF token and aalready allows for configuring a cookie name. So, by making it public and configurable in the DSL, both of these tickets quite naturally close. Closes spring-projectsgh-13841 Closes spring-projectsgh-14904
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
The current OIDC back-channel logout support saves the end-user's CSRF token to use in a self-logout call when the back-channel request comes from the authorization server.
This adds more information to
OidcSessionInformationthan may be necessary. Instead, I think it would also work to send thelogout_tokenin place of the CSRF token.The upside is a simpler contract and simpler configuration. The possible downside is the logout token is validated multiple times, once for each session being invalidated.
The text was updated successfully, but these errors were encountered: