Expired ID tokens are rejected at the authorization server on an RP-initiated logout

[sjohnr]

Describe the bug

Expired ID tokens are rejected at the authorization server on an RP-initiated logout.

To Reproduce

Using the included samples:

1. Log in with the client using OIDC.
2. Wait 30 minutes.
3. Log out using RP-initiated logout and receive a 400 error for id_token_hint parameter.

Expected behavior

Per the OpenID Connect RP-Initiated Logout 1.0 specification:

The OP SHOULD accept ID Tokens when the RP identified by the ID Token’s aud claim and/or sid claim has a current session or had a recent session at the OP, even when the exp time has passed.

[maradanasai]

Hi @sjohnr Thanks for reporting this. I'm able to reproduce this, thought of reporting it here