revoking offline_access refresh tokens

[Joseph Heenan]

As per Mike’s WGLC message, I noticed that:

https://openid.net/specs/openid-connect-backchannel-1_0-07.html#BCActions

contains the text:

NOTE: An open issue for the specification is whether to define an additional optional parameter in the logout token, probably as a value in the event-specific parameters JSON object, that explicitly signals that offline_access refresh tokens are also to be revoked.

I presume that text should be altered/removed before going to final.

[Michael Jones]

Will be fixed by https://bitbucket.org/openid/connect/pull-requests/158/removed-note-about-revoking-offline_access

[Andrii Deinega]

https://openid.net/specs/openid-connect-backchannel-1_0-07.html#LogoutToken included this text

The Logout Token is compatible with the Security Event Token (SET) [RFC8417] specification.

these tokens have different values for the “typ“ header parameter, “secevent+jwt” and “logout+jwt“. This parameter is optional in both cases but if specified, they aren’t 100% compatible.

‌

[Michael Jones]

Fixed by https://bitbucket.org/openid/connect/pull-requests/158/removed-note-about-revoking-offline_access