Hockenba commented on code in PR #13651:
URL: https://github.com/apache/apisix/pull/13651#discussion_r3891867728
##########
apisix/plugins/openid-connect.lua:
##########
@@ -294,7 +294,19 @@ local schema = {
description = "keepalive timeout in milliseconds",
},
}
- }
+ },
+ revocation = {
+ type = "string",
+ enum = {"redis"},
+ description = "Redis-backed revocation for cookie
sessions.",
+ },
+ revocation_fail_mode = {
+ type = "string",
+ enum = {"open", "closed"},
Review Comment:
Not sure if the AI is correct on this one (I'll double check in the
morning), but my understanding is that the logout flow may be intentionally
designed for or we may desire that ourselves for best-effort session deletions
and revocations - so users can still log out even during Redis outages (since
the session cookie gets deleted still). The trade-off is accepting a small
window where sessions could theoretically be replayed after recovery (unlikely).
If we prefer stricter consistency guarantees, we have two options: add
explicit failure handling now, or defer it for later review. Happy to move in
whichever direction makes the most sense for the project.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
