Hockenba commented on code in PR #13651:
URL: https://github.com/apache/apisix/pull/13651#discussion_r3891867728
##########
apisix/plugins/openid-connect.lua:
##########
@@ -294,7 +294,19 @@ local schema = {
description = "keepalive timeout in milliseconds",
},
}
- }
+ },
+ revocation = {
+ type = "string",
+ enum = {"redis"},
+ description = "Redis-backed revocation for cookie
sessions.",
+ },
+ revocation_fail_mode = {
+ type = "string",
+ enum = {"open", "closed"},
Review Comment:
Not sure if the AI is correct on this one (I'll double check in the
morning), but my understanding is that the logout flow may be intentionally
designed for best-effort revocation/session deletions - so users can still log
out even during Redis outages (since the session cookie gets deleted still).
The trade-off is accepting a small window where sessions could theoretically be
replayed after recovery (unlikely).
If we prefer stricter consistency guarantees, we have two options: add
explicit failure handling now, or defer it for later review. Happy to move in
whichever direction makes the most sense for the project.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
