Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

EndSession enpoint should accept either id_token or session_state in order to end session #439

Closed
yurem opened this issue Jan 16, 2017 · 1 comment
Assignees
Labels
enhancement libs update, re-factroring, etc.
Milestone

Comments

@yurem
Copy link
Contributor

yurem commented Jan 16, 2017

We decided to not include update which accept only session_state instead of id_token into 2.4.4 SP2 to avoid breaking compatibility.

I think in 3.0.0 we can include this. But it should accept both id_token (OPTIONAL according spec) and session_state (our custom parameter).

The workflow should be next:

if (id_token is exists) {
// end_session using id_token
} else if (session_state is exists) {
// end_session using session_state
} else {
// throws error about missing paramters
}

@yurem yurem added the enhancement libs update, re-factroring, etc. label Jan 16, 2017
@yurem yurem added this to the CE 3.0.0 milestone Jan 16, 2017
@yurem yurem self-assigned this Jan 16, 2017
yurem added a commit that referenced this issue Jan 20, 2017
@yurem
Copy link
Contributor Author

yurem commented Jan 20, 2017

Implemented

@yurem yurem closed this as completed Jan 20, 2017
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement libs update, re-factroring, etc.
Projects
None yet
Development

No branches or pull requests

1 participant