Copilot commented on code in PR #13651:
URL: https://github.com/apache/apisix/pull/13651#discussion_r3891687189
##########
apisix/plugins/openid-connect.lua:
##########
@@ -294,7 +294,19 @@ local schema = {
description = "keepalive timeout in milliseconds",
},
}
- }
+ },
+ revocation = {
+ type = "string",
+ enum = {"redis"},
+ description = "Redis-backed revocation for cookie
sessions.",
+ },
+ revocation_fail_mode = {
+ type = "string",
+ enum = {"open", "closed"},
Review Comment:
`closed` is not safely supported by the current logout path.
`lua-resty-session` 4.2 returns an error from `destroy()` and leaves the
session open when Redis is unreachable, but the pinned `lua-resty-openidc`
1.9.0 calls `session:destroy()` without checking its return value and continues
the logout redirect. The user therefore sees a successful logout while the
original cookie becomes valid again after Redis recovers. Please make the
OpenIDC logout path propagate this failure (or handle destruction in APISIX)
before exposing `closed`, and cover a Redis-outage logout/replay case.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
