Eric Chiang

Thanks! For what it's worth, I think adding support for supplementary specs is great. I'd just want to figure out if there's any additional API we can present more than...

Are you actually hitting issues or is this theoretical? Retry strategies are usually documented as part of your API contract (e.g. https://google.aip.dev/194). To the best of my knowledge, there's nothing...

For some additional context, this library used to implement Cache-Control header parsing. It ended up causing more headaches than it solved, and was ripped out eventually. https://github.com/coreos/go-oidc/pull/259

Sounds good! I think my main concern is if we hit a net deadline (e.g. timing out after 30 seconds and not getting an HTTP response). Retrying that operation might...

Do you have a sense of what API additions would be needed from go-oidc to support this? Briefly looking at the spec, it seems like this might be more suitable...

Thanks for the reply! Any additional metadata endpoints can be retrieved through https://pkg.go.dev/github.com/coreos/go-oidc/v3/oidc#Provider.Claims (We should really have a better name for that method)

Yeah this sounds reasonable, feel free to send a PR!

If you'd like to send a PR to limit the amount of information read, happy to take it!

This package currently doesn't implement logout token logic. It'd be helpful to know what providers implement this and what real-world use cases look like.

Since those specs are still a Draft we'd probably want to wait before adding new APIs to this package. You should be able to use most of the Verify method...