Describe the bug We're using the following link when we refer to the OIDC RP-Initiated Logout feature:
https://openid.net/specs/openid-connect-session-1_0.html#RPLogout
But it seems this spec is not related to the feature anymore, in fact, the #RPLogout fragment doesn't seem to correspond to any section/element in the document.
This seems to be the correct link to the RP-Initiated spec:
https://openid.net/specs/openid-connect-rpinitiated-1_0.html
To Reproduce Browse the following section in our docs:
https://docs.spring.io/spring-security/reference/servlet/oauth2/login/advanced.html#oauth2login-advanced-oidc-logout
and click on the following link:
One of the strategies available is RP-Initiated Logout.
The link will redirect to an OIDC spec that doesn't contain much RP-Initiated Logout info, which might be a little misleading.
Expected behavior The links should point to the correct OIDC Spec:
https://openid.net/specs/openid-connect-rpinitiated-1_0.html
Sample N/A
Comment From: rozagerardo
Here is a small PR to fix this, in case you agree the links should be updated:
https://github.com/spring-projects/spring-security/pull/12082