Jto/updates id token hint #3944
Conversation
| **OAuth Logout Endpoint and the id_token_hint** | ||
|
|
||
| Now that we are identifying an `id_token` using the newly added `tty` claim, we are now correctly rejecting an `access_token` when used as the `id_token_hint` parameter (this aligns with the OAuth spec). If you had previously built an integration to send an `access_token` as the `id_token_hint` parameter instead of the `id_token` you will need to correct your integration before upgrading to this version. | ||
|
|
There was a problem hiding this comment.
Now that we are identifying an
id_tokenusing the newly addedttyclaim, the OAuth2 Logout endpoint will now correctly reject anaccess_tokenwhen sent as theid_token_hintparameter according to spec. If you have any integrations that are sending anaccess_tokenin theid_token_hintparameter instead of theid_tokenyou will need to correct your integration prior to upgrading.
There was a problem hiding this comment.
Looks good. I left one more comment for the heading - let's keep that short to match the other headings in this section.
parameter (this aligns with the OAuth spec).
IMO using parens is not great, this feels like an aside. Maybe better to just drop this since we already are saying we are now correctly rejecting this parameter and just say:
when used as the
id_token_hintparameter.
And I think it is redundant to say to this version since this is part of the release notes for this version.
your integration before upgrading to this version.
Ensure you have reviewed the copy suggested in these comments:
No description provided.