invalidate invalid handles.

1 files changed, 3 insertions, 1 deletions

diff --git a/lib/server.cc b/lib/server.cc
index 51d4554..5eee1f3 100644
--- a/lib/server.cc
+++ b/lib/server.cc
@@ -69,39 +69,41 @@ namespace opkele {
 
     void server_t::checkid_immediate(const params_t& pin,string& return_to,params_t& pout) {
         checkid_(mode_checkid_immediate,pin,return_to,pout);
     }
 
     void server_t::checkid_setup(const params_t& pin,string& return_to,params_t& pout) {
         checkid_(mode_checkid_setup,pin,return_to,pout);
     }
 
     void server_t::checkid_(mode_t mode,const params_t& pin,string& return_to,params_t& pout) {
         if(mode!=mode_checkid_immediate && mode!=mode_checkid_setup)
             throw bad_input(OPKELE_CP_ "invalid checkid_* mode");
+        pout.clear();
         assoc_t assoc;
         try {
             assoc = retrieve_assoc(pin.get_param("openid.assoc_handle"));
         }catch(failed_lookup& fl) {
             // no handle specified or no valid handle found, going dumb
             assoc = alloc_assoc(mode_checkid_setup);
+            if(pin.has_param("openid.assoc_handle"))
+                pout["invalidate_handle"]=pin.get_param("openid.assoc_handle");
         }
         string trust_root;
         try {
             trust_root = pin.get_param("openid.trust_root");
         }catch(failed_lookup& fl) { }
         string identity = pin.get_param("openid.identity");
         return_to = pin.get_param("openid.return_to");
         validate(*assoc,pin,identity,trust_root);
-        pout.clear();
         pout["mode"] = "id_res";
         pout["assoc_handle"] = assoc->handle();
         if(pin.has_param("openid.assoc_handle") && assoc->stateless())
             pout["invalidate_handle"] = pin.get_param("openid.assoc_handle");
         pout["identity"] = identity;
         pout["return_to"] = return_to;
         /* TODO: eventually remove deprecated stuff */
         time_t now = time(0);
         pout["issued"] = util::time_to_w3c(now);
         pout["valid_to"] = util::time_to_w3c(now+120);
         pout["exipres_in"] = "120";
         pout.sign(assoc->secret(),pout["sig"],pout["signed"]="mode,identity,return_to");