membphis commented on PR #14030: URL: https://github.com/apache/apisix/pull/14030#issuecomment-6433601015
The updated documentation and tests make the false/null fallback policy explicit, so I am no longer treating the earlier source-precedence comment as a blocker. Non-blocking suggestion: add a regression for a session whose ID token has been refreshed while UserInfo remains cached, and document that fallback does not guarantee fresher data. In lua-resty-openidc 1.9.0, login stores UserInfo in the session, normal requests reuse it, and a token refresh can replace the ID token without refreshing UserInfo ([refresh logic](https://github.com/zmartzone/lua-resty-openidc/blob/v1.9.0/lib/resty/openidc.lua#L1971-L2003), [session lookup](https://github.com/zmartzone/lua-resty-openidc/blob/v1.9.0/lib/resty/openidc.lua#L2173-L2178)). For example, a refreshed ID token with `admin=false` can still fall back to an older UserInfo value of `admin=true` under this policy. Please pin that intended behavior in a regression, and also cover clearing a client-supplied mapped header when neither source yields a value to forward. This caveat is especially relevant when upstreams use mapped headers for authorization. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
