Handle session token revocation#1181

Merged

julien-nc merged 5 commits intomainfrom

enh/noid/handle-session-token-revocation

Aug 29, 2025

Commits on Aug 29, 2025

feat(revoke-token): react to a user session being revoked, call the IdP's end_session_endpoint to make sure it's not possible to login again from the invalidated browser session
julien-nc
committed
feat(revoke-token): add a timeout when requesting the end_session_endpoint, cleanup our own oidc session when a token has been invalidated
julien-nc
committed
feat(revoke-token): adjust to changes in the event
julien-nc
committed
feat(revoke-token): encrypt login id token in session db row
julien-nc
committed
feat(revoke-token): on login, if there already is a oc_user_oidc_sessions row with the SID, update it
julien-nc
committed