What is intent of ID Token expiry time in OpenID Connect?

后端 未结 7 2063
梦谈多话
梦谈多话 2020-12-12 09:24

In OpenID Connect an access token has an expiry time. For authorization code flow, this is typically short (eg 20 minutes) after which you use the refresh token to

7条回答
  •  陌清茗
    陌清茗 (楼主)
    2020-12-12 09:49

    I wanted to post this answer as a comment but since I haven't been very active on StackOverflow, I guess I'm posting it as an alternate answer.

    You also use id_token as the id_token_hint when attempting to log the user out of a session http://openid.net/specs/openid-connect-session-1_0.html. I honestly don't think that it really matters if the id_token is expired at this point since you're only concerned about logging out a particular user.

提交回复
热议问题