Error on Sign Out

[nwoolls]

Hi there. I am running into an issue with this sample (as well as our own application).

If I run the OIDC sample I can sign in, view user info, and sign out no problem.

However, if I sign in, and then stay on the home page for 1h+, long enough for the ID token to expire, and then click Sign Out, I get an error in PingOne:

id:	
3c38cc1c-cd52-4693-bd7c-7c1c63ad075f

code:	
INVALID_DATA

details:	
code:	
INVALID_VALUE

target:	
id_token_hint

message:	
Invalid ID token hint: The token is no longer valid

Any guidance on this would be appreciated.

[nwoolls]

FWIW I've reproduced this with both .NET 6 and .NET 8 RC2.

[nwoolls]

FWIW I was able to work around this by using middleware based on the following:

https://devforum.okta.com/t/get-token-from-asp-net-core-to-pass-to-backend-as-verification/5914/6

Is this truly necessary? I get what it's doing, and why, but it seems excessive just to make sign out work after 1h.

[dbrowski]

Hi, can you describe what you're expecting to see happen or your use case? And what would be considered a successful sign out (the session or access token or something else)?
Just need some more info to see what the easiest/best solution would be.

[nwoolls]

@dbrowski the same thing that happens when you click Sign Out in < 1h. e.g. not an error in PingOne.

[dbrowski]

Ok, yes, I see what you're pointing out now. Let me see if we can reproduce the issue and look into what might be the problem.

[AndersAbel]

The logout is described in the OpenID Connect RP-Initiated Logout 1.0 spec. Section 2 states that:

The OP SHOULD accept ID Tokens when the RP identified by the ID Token's aud claim and/or sid claim has a current session or had a recent session at the OP, even when the exp time has passed

The interpretation of SHOULD is defined in RFC2119 as

This word, or the adjective "RECOMMENDED", mean that there may exist valid reasons in particular circumstances to ignore a particular item, but the full implications must be understood and carefully weighed before choosing a different course.

To me, it looks like an OP should not validate the exp of the id_token_hint, unless there are specific reasons to do it.

[nwoolls]

@dbrowski just to add to what @AndersAbel quoted, I believe I still have a session w/ PingOne. Once you reproduce this you should be able to confirm that by clicking "Sign In" after the error occurs. At that point, you are signed into PingOne without being prompted for credentials as the session is still live.