Interface IEndSessionRequestValidator

Namespace: Fdyay.IdentityServer.Validation

Assembly: Fdyay.IdentityServer.Core.dll

Validates an end-session request.

public interface IEndSessionRequestValidator

Remarks

Duende 8.0.1's IEndSessionRequestValidator, measured: with RequireAuthenticatedUserForSignOutMessage, an anonymous request is refused; an id_token_hint is validated by the token validator, without its lifetime, and its audience is the client; for a signed-in user, the hint must name their session — its sid theirs, or with no sid its sub them — or the request is refused, and a host may ask for confirmation instead; the post_logout_redirect_uri is kept when the redirect URI validator accepts it for the client, and state only beside it. Duende's ValidateCallbackAsync is not adopted: this server has no end-session callback endpoint, its signed-out page carrying the front-channel notifications.

Methods

ValidateAsync(IReadOnlyDictionary<string, string>, ClaimsPrincipal?, CancellationToken)

Validates an end-session request's parameters against the signed-in user.

Task<EndSessionValidationResult> ValidateAsync(IReadOnlyDictionary<string, string> parameters, ClaimsPrincipal? subject, CancellationToken ct)

Parameters

parameters IReadOnlyDictionary<string, string>: The request's parameters: id_token_hint, post_logout_redirect_uri, state, ui_locales.
subject ClaimsPrincipal: The signed-in user, when there is one.
ct CancellationToken: Cancels the validation.

Returns