parallel refresh token

[shayannyc25]

hi

as per https://github.com/OpenIDC/mod_auth_openidc/wiki/Known-Limitations#parallel-refresh-token-grants , does the mitigation mentioned here that was introduced in 2.4.14.4 will work across many apache web servers hosted in different servers? does the mitigation work with distributed file/Nas drive as shared cache?

[zandbelt]

I have updated the text in the article. It does work indeed (when enabled with the environment variable as documented) with a filesystem as a shared cache, assuming all Apache processes use the same cache, with the caveats as mentioned in the article.

[zandbelt]

FYI: the approach changed a little bit (and the enviroment variable was removed), see https://github.com/OpenIDC/mod_auth_openidc/releases/tag/v2.4.15.3