@@ -110,11 +110,24 @@ func (p *OIDCProvider) EnrichSession(_ context.Context, s *sessions.SessionState
110110 return nil
111111}
112112
113−// ValidateSession checks that the session's IDToken is still valid
113+// ValidateSession checks that the session's id_token or access_token (when a ValidateURL is configured) is still valid
114114func (p *OIDCProvider) ValidateSession(ctx context.Context, s *sessions.SessionState) bool {
115115 ctx = oidc.ClientContext(ctx, requests.DefaultHTTPClient)
116− _, err := p.Verifier.Verify(ctx, s.IDToken)
117− if err != nil {
116+
117+ // https://openid.net/specs/openid-connect-core-1_0.html#RefreshTokenResponse
118+ // The ID Token is optional in the Refresh Token Response
119+ // TODO: @tuunit remove dependency on refreshed flag and only rely on presence of access_token
120+ // in accordance with the spec. For now, keep existing behavior.
121+ if s.Refreshed {
122+ if !validateToken(ctx, p, s.AccessToken, makeOIDCHeader(s.AccessToken)) {
123+ logger.Errorf("access_token validation failed")
124+ return false
125+ }
126+
127+ return true
128+ }
129+
130+ if _, err := p.Verifier.Verify(ctx, s.IDToken); err != nil {
118131 logger.Errorf("id_token verification failed: %v", err)
119132 return false
120133 }
@@ -122,8 +135,8 @@ func (p *OIDCProvider) ValidateSession(ctx context.Context, s *sessions.SessionS
122135 if p.SkipNonce {
123136 return true
124137 }
125− err = p.checkNonce(s)
126− if err != nil {
138+
139+ if err := p.checkNonce(s); err != nil {
127140 logger.Errorf("nonce verification failed: %v", err)
128141 return false
129142 }
@@ -147,7 +160,8 @@ func (p *OIDCProvider) RefreshSession(ctx context.Context, s *sessions.SessionSt
147160}
148161
149162// redeemRefreshToken uses a RefreshToken with the RedeemURL to refresh the
150−// Access Token and (probably) the ID Token.
163+// Access Token and (optionally) the ID Token.
164+// https://openid.net/specs/openid-connect-core-1_0.html#RefreshTokenResponse
151165func (p *OIDCProvider) redeemRefreshToken(ctx context.Context, s *sessions.SessionState) error {
152166 clientSecret, err := p.GetClientSecret()
153167 if err != nil {
@@ -250,6 +264,7 @@ func (p *OIDCProvider) createSession(ctx context.Context, token *oauth2.Token, r
250264
251265 ss.CreatedAtNow()
252266 ss.SetExpiresOn(token.Expiry)
267+ ss.Refreshed = refresh
253268
254269 return ss, nil
255270}