R87: validate backchannel logout token exp; live-refresh JWKS for logout kid-miss

2026-10-21 04:57:48 +00:00 · 2026-08-13 18:59:52 +01:00
parent 39b3c53d82
commit 9e39827f7d
5 changed files with 165 additions and 66 deletions
@@ -76,6 +76,7 @@ func TestBackchannelLogout_RejectsReplayedJTI(t *testing.T) {
 			"iss": "https://provider.example.com",
 			"aud": "test-client",
 			"iat": time.Now().Unix(),
+			"exp": time.Now().Add(time.Hour).Unix(),
 			"jti": "unique-jti-123",
 			"events": map[string]interface{}{
 				"http://schemas.openid.net/event/backchannel-logout": map[string]interface{}{},