@@ -117,14 +117,12 @@ func (p *OIDCProvider) ValidateSession(ctx context.Context, s *sessions.SessionS
117117
118118 // https://openid.net/specs/openid-connect-core-1_0.html#RefreshTokenResponse
119119 // The ID Token is optional in the Refresh Token Response
120− // TODO: @tuunit remove dependency on refreshed flag and only rely on presence of access_token
121− // in accordance with the spec. For now, keep existing behavior.
122120 if s.Refreshed {
123− if !validateToken(ctx, p, s.AccessToken, makeOIDCHeader(s.AccessToken)) {
121+ validateEndpointAvailable := p.Data().ValidateURL != nil && p.Data().ValidateURL.String() != ""
122+ if validateEndpointAvailable && !validateToken(ctx, p, s.AccessToken, makeOIDCHeader(s.AccessToken)) {
124123 logger.Errorf("access_token validation failed")
125124 return false
126125 }
127−
128126 return true
129127 }
130128
@@ -190,9 +188,8 @@ func (p *OIDCProvider) redeemRefreshToken(ctx context.Context, s *sessions.Sessi
190188 return fmt.Errorf("unable create new session state from response: %v", err)
191189 }
192190
193− // It's possible that if the refresh token isn't in the token response the
194− // session will not contain an id token.
195− // If it doesn't it's probably better to retain the old one
191+ // It's possible that a refresh does not renew the ID Token.
192+ // If it doesn't, it's probably better to retain the old one.
196193 if newSession.IDToken != "" {
197194 s.IDToken = newSession.IDToken
198195 s.Email = newSession.Email
@@ -205,6 +202,7 @@ func (p *OIDCProvider) redeemRefreshToken(ctx context.Context, s *sessions.Sessi
205202 s.RefreshToken = newSession.RefreshToken
206203 s.CreatedAt = newSession.CreatedAt
207204 s.ExpiresOn = newSession.ExpiresOn
205+ s.Refreshed = newSession.Refreshed
208206
209207 return nil
210208}