IdentityServer icon indicating copy to clipboard operation
IdentityServer copied to clipboard

Infinite loop when max_age=0

Open RolandGuijt opened this issue 9 months ago • 0 comments

In v7 the login page is displayed over and over again when the max_age parameter in an authorization endpoint request is set to 0.

It is cause by the fact that the new time provider abstraction changed how we handle this case in practice. We want to treat max_age=0 as a special case because

  • current behavior is buggy
  • it is specifically mentioned in the spec as being equivalent to prompt=login
  • handling it as a special case (only remove when the parameter is 0) makes it a bug fix instead of a breaking change

https://github.com/DuendeSoftware/Support/issues/1229

RolandGuijt avatar Apr 29 '24 14:04 RolandGuijt