User avatar
Celeste_transbian flori_ava_star:~cursor_blinkingbadge-petting-encouraged badge-biting-allowed @star@amazonawaws.com
1mo
It is, to me, crazy that OIDC is the best thing we collectively have as an industry, and it just doesn't specify things such as... how to list all active sessions. Honestly, OIDC is very nice, but WOW does it have a *lot* of gaps which force you to do really funky shit to be able to have functionality which sounds very basic on the surface
❤️1
1
0
6
1
User avatar
aura @aura@gts.foxsnuggl.es
1mo
@star uhhh, that's super out of scope?
1
0
0
0
User avatar
Celeste_transbian flori_ava_star:~cursor_blinkingbadge-petting-encouraged badge-biting-allowed @star@amazonawaws.com
1mo
@aura I would argue it is not out of scope. You already have session management. There should just be an RFC extending on this.
2
0
0
0
User avatar
aura @aura@gts.foxsnuggl.es
1mo
@star except you really don't have session management, you have some primitives in an optional spec that can pretty much only signal a logout event
1
0
0
0
User avatar
aura @aura@gts.foxsnuggl.es
1mo
@star also imo that spec is incredibly silly, if you want the same properties, issue shorter tokens and refresh once it expires (or use back-channel logout which checks more compliance boxes anyway)
2
0
0
0
User avatar
Celeste_transbian flori_ava_star:~cursor_blinkingbadge-petting-encouraged badge-biting-allowed @star@amazonawaws.com
1mo
@aura Yes true but to me it's just about having a standard for it, so that I know that stuff I design works with multiple IdPs
1
0
0
0
User avatar
aura @aura@gts.foxsnuggl.es
1mo
@star just out of curiosity, why do you need to list sessions if you're the RP? you get to know about all sessions anyway if you use a confidential client.
1
0
0
0
User avatar
Celeste_transbian flori_ava_star:~cursor_blinkingbadge-petting-encouraged badge-biting-allowed @star@amazonawaws.com
1mo
@aura Well, all sessions that the RP has seen already, but you don't know all the tokens that COULD be valid
1
0
0
0
User avatar
aura @aura@gts.foxsnuggl.es
1mo
@star on a confidential client you do, because you call the token endpoint for the user (because you need the client secret)
1
0
0
0
User avatar
Celeste_transbian flori_ava_star:~cursor_blinkingbadge-petting-encouraged badge-biting-allowed @star@amazonawaws.com
1mo
@aura Yes but you can also get tokens which you didn't get from that specific RP, which could be valid for use with that RP
1
0
0
0
User avatar
aura @aura@gts.foxsnuggl.es
1mo
@star as long as you validate the aud claim and use an access token (or, better, use token exchange) 🙏

i've seen people reuse one token for a microservice request chain before and... that's just as fucked of a threat model as trusting services outright
1
0
1
0
User avatar
Celeste_transbian flori_ava_star:~cursor_blinkingbadge-petting-encouraged badge-biting-allowed @star@amazonawaws.com
1mo
@aura too eepy to fully think this through but ur right yea, i think that could work! thank you very much either way :)
0
0
1
0