DependencyTrack / DependencyTrack/dependency-track
OIDC initiated sessions should listen for channel logout
Open
enhancement
- Dominant language
- Java
- Stars
- 4.2k
- Forks
- 811
- Avg merge
- 8h
- Merged PRs (30d)
- 233
Description
### Current Behavior:
- User connects to DT through OIDC
- User session gets forcibly closed from the OpenID Provider (OP)
-> User remains logged (forever) in DT
Reason: DT token does not expire, DT FrontEnd not aware of logout through OP
### Proposed Behavior:
Implement either [Front Channel Logout](https://openid.net/specs/openid-connect-frontchannel-1_0.html) or [Back Channel Logout](https://openid.net/specs/openid-connect-backchannel-1_0.html)
Second approach is more robust but would require a complete paradigm shift in the current session management approach used by DT.
Contributor guide
Assessment
This issue has not been assessed yet.