IdentityServer
IdentityServer copied to clipboard
Infinite loop when max_age=0
In v7 the login page is displayed over and over again when the max_age parameter in an authorization endpoint request is set to 0.
It is cause by the fact that the new time provider abstraction changed how we handle this case in practice. We want to treat max_age=0 as a special case because
- current behavior is buggy
- it is specifically mentioned in the spec as being equivalent to prompt=login
- handling it as a special case (only remove when the parameter is 0) makes it a bug fix instead of a breaking change
https://github.com/DuendeSoftware/Support/issues/1229