OpenID Connect Back-Channel Logout 1.0: Explicit typing of the logout token?

[Vladimir Dzhuvinov]

The current 06 draft doesn’t specify whether the logout token may be or is required to be explicitly typed, according to the referenced SET RFC 8417.

https://openid.net/specs/openid-connect-backchannel-1_0.html#LogoutToken

https://www.rfc-editor.org/rfc/rfc8417.html#section-2.3

[Michael Jones]

I would propose that register the media type “application/logout+jwt“ for this purpose and makes its use RECOMMENDED for Logout Tokens.

[Michael Jones]

This is fixed by https://bitbucket.org/openid/connect/pull-requests/155/support-explicit-typing-of-logout-tokens .

[Michael Jones]

Fixed by https://bitbucket.org/openid/connect/pull-requests/155/support-explicit-typing-of-logout-tokens .