Hockenba commented on code in PR #13651:
URL: https://github.com/apache/apisix/pull/13651#discussion_r3891867728
##########
apisix/plugins/openid-connect.lua:
##########
@@ -294,7 +294,19 @@ local schema = {
description = "keepalive timeout in milliseconds",
},
}
- }
+ },
+ revocation = {
+ type = "string",
+ enum = {"redis"},
+ description = "Redis-backed revocation for cookie
sessions.",
+ },
+ revocation_fail_mode = {
+ type = "string",
+ enum = {"open", "closed"},
Review Comment:
Not sure if the AI is correct on this one (I'll double-check in the
morning), but my understanding is that the logout flow may be intentionally
designed—or something we'd want—for best-effort session deletion and
revocation. This way, users can still log out during Redis outages since the
client-side cookie gets cleared regardless. The trade-off is accepting a small
window where the session could theoretically become valid again after Redis
recovers (though unlikely).
If we'd prefer fail-closed behavior (i.e., the logout should explicitly fail
if server-side revocation can't be confirmed), we can either add that handling
now or defer it as a later improvement. Happy to move in whichever direction
makes the most sense for the project.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
