DependencyTrack / DependencyTrack/dependency-track

OIDC initiated sessions should listen for channel logout

Open
#2,016 0 comments 0 reactions 0 assignees View on GitHub
enhancement
Dominant language
Java
Stars
4.2k
Forks
811
Avg merge
8h
Merged PRs (30d)
233

Description

### Current Behavior:

- User connects to DT through OIDC
- User session gets forcibly closed from the OpenID Provider (OP)

-> User remains logged (forever) in DT

Reason: DT token does not expire, DT FrontEnd not aware of logout through OP

### Proposed Behavior:

Implement either [Front Channel Logout](https://openid.net/specs/openid-connect-frontchannel-1_0.html) or [Back Channel Logout](https://openid.net/specs/openid-connect-backchannel-1_0.html)

Second approach is more robust but would require a complete paradigm shift in the current session management approach used by DT.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.