LogoutTokenExpiryStep Class

Requires exp to be present and still in the future, inverting the rule of the step it replaces.

public sealed class LogoutTokenExpiryStep : Abblix.SecurityEvents.Validation.ISecurityCriticalValidator, Abblix.SecurityEvents.Validation.ISecurityEventTokenValidator

Inheritance System.Object → LogoutTokenExpiryStep

Implements ISecurityCriticalValidator, ISecurityEventTokenValidator

Remarks

OpenID Connect Back-Channel Logout 1.0 Section 2.6 step 4 asks that the "iss, aud, iat, and exp Claims" be validated "in the same way they are validated in ID Tokens", where OpenID Connect Core 1.0 Section 2 makes exp REQUIRED. A SET forbids the same claim, which is why this replacement exists rather than an addition: the two rules cannot both hold, and a profile carrying both would refuse every token either way.

The expiry is what bounds how long a captured Logout Token stays usable, which Section 4 asks providers to keep short - "preferably at most two minutes in the future, to prevent captured Logout Tokens from being replayable". The replay guard covers that window; this step is what makes the window finite, so the guard has something to forget.

The same tolerance the profile allows an issue time is allowed here, for the reason RFC 8417 Section 5.3 gives about timestamps across distributed systems: the receiver's clock is not the issuer's. Security-critical, because it replaces a critical step and polices the same claim with the opposite sign. It deliberately does not establish the state that step establishes: that flag says the claim is ABSENT, which is the answer this profile gives the other way round, and a later step asking for it would be asking a question this profile answers differently.

Constructors

LogoutTokenExpiryStep(TimeProvider) Constructor

Requires exp to be present and still in the future, inverting the rule of the step it replaces.

public LogoutTokenExpiryStep(System.TimeProvider clock);

Parameters

`clock` System.TimeProvider

The receiver's clock; a test hands in a fake to pin the window.

Remarks

Methods

LogoutTokenExpiryStep.ValidateAsync(SecurityEventTokenValidationContext, CancellationToken) Method

Checks the token in flight.

public System.Threading.Tasks.ValueTask<Abblix.SecurityEvents.Validation.SecurityEventTokenValidationError?> ValidateAsync(Abblix.SecurityEvents.Validation.SecurityEventTokenValidationContext context, System.Threading.CancellationToken cancellationToken);