Skip to content

Added mandatory support of prompt=login #8

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
deansaxe wants to merge 3 commits into
base: main
Choose a base branch
from
Open

Added mandatory support of prompt=login #8

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
b152d32
Added mandatory support of prompt=login
deansaxe Jul 15, 2025
f9a02bf
Minor update to the prompt
deansaxe Jul 16, 2025
eafbde0
Minor update to language on prompt param.
deansaxe Jul 16, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions draft-openid-ipsie-sl1-profile.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -198,6 +198,7 @@ For the authorization code flow, OpenID Providers:
* SHOULD use the HTTP 303 status code when redirecting the user agent using status codes;
* MUST support `nonce` parameter values up to 64 characters in length, and MAY reject `nonce` values longer than 64 characters.
* MUST support the `max_age` parameter with a values representing the maximum number of seconds allowable since the user was authenticated by the OP. If the elapsed time since authentication is less than this value, the OP MAY choose to actively reauthenticate the user. If the elapsed time since authentication is greater than this value, the OP MUST actively reauthenticate the user.
* MUST support the `prompt=login` parameter by requiring user-interactive reauthentication of the user when this parameter is received from the RP.

Note 1: while both nonce and PKCE can provide protection from authorization code injection, nonce relies on the client (RP) to implement and enforce the check, and the IdP is unable to verify that it has been implemented correctly, and only stops the attack after tokens have already been issued. Instead, PKCE is enforced by the IdP and stops the attack before tokens are issued.

Expand Down