search

DuendeSoftware / IdentityServer

The most flexible and standards-compliant OpenID Connect and OAuth 2.x framework for ASP.NET Core
https://duendesoftware.com/products/identityserver
Other
1.45k stars 337 forks source link

Consider adding more validation to processed max_age and prompt #1567

Open josephdecock opened 3 months ago

josephdecock commented 3 months ago

If the pushed max_age and auth time don't make sense together, perhaps we ignore the processed_max_age? And perhaps we do similar for prompt=login?

Unsure if we can/should do the same for prompt=create or prompt=select_account (the other processed prompt values).