Session - 3.2 Session Management Endpoints: GET or POST?

[OpenID Foundation]

The text says:

{{{ Authorization servers MUST support the use of the HTTP "GET" method as define in RFC 2616 }}}

(besides the typo: s/define/defined/) Do we really want it to support "GET"? Would it not leak the session? Should it not be POST?

[Nat Sakimura]

Make at least POST required.

[John Bradley]

Session management under review.

[John Bradley]

Session management is on hold

[Michael Jones]

This issue is almost certainly defunct, because the spec has been rewritten. John, if you believe there is still an issue, please reopen and add comments.