Experience with OIDC plugin

[Cantor, Scott]

>  First about the session storage. When accessing UserInfo endpoint OIDC
> expects for OP to verify user presence unless request has offline_access scope.
> The extension does it by verifying user session still exists.

I don't think you can prove presence on the back channel, and isn't the only way to get one of these codes on the front channel to have done authentication or SSO? Shouldn't they be just be short lived and assumed to be issued with a user having logged in to produce them?

-- Scott