Merge pull request #28 from itk-dev/feature/unique-token-keys-for-oidcs-providers

Generate and use unique token keys across OIDC providers

Author: jekuaitk

CHANGELOG.md

@@ -8,6 +8,10 @@ and this project adheres to [Semantic Versioning](http://semver.org/).
 
 ## [Unreleased]
 
+## [2.5.0] 2026-07-14
+
+* Use unique token keys for OIDC providers.
+
 ## [2.4.1] 2026-04-21
 
 * Fetched providers as array when displaying them.
@@ -49,7 +53,8 @@ and this project adheres to [Semantic Versioning](http://semver.org/).
 
 * Allowed multiple providers.
 
-[Unreleased]: https://github.com/itk-dev/os2forms_nemlogin_openid_connect/compare/2.4.1...HEAD
+[Unreleased]: https://github.com/itk-dev/os2forms_nemlogin_openid_connect/compare/2.5.0...HEAD
+[2.5.0]: https://github.com/itk-dev/os2forms_nemlogin_openid_connect/compare/2.4.1...2.5.0
 [2.4.1]: https://github.com/itk-dev/os2forms_nemlogin_openid_connect/compare/2.4.0...2.4.1
 [2.4.0]: https://github.com/itk-dev/os2forms_nemlogin_openid_connect/compare/2.3.1...2.4.0
 [2.3.1]: https://github.com/itk-dev/os2forms_nemlogin_openid_connect/compare/2.3.0...2.3.1

src/Plugin/os2web/NemloginAuthProvider/OpenIDConnect.php

@@ -239,7 +239,7 @@ public function logout() {
    * @phpstan-param array<string, mixed> $token
    */
   public function setToken(array $token): self {
-    $this->session->set(self::SESSION_TOKEN, $token);
+    $this->session->set($this->getTokenKey(), $token);
 
     return $this;
   }
@@ -250,9 +250,10 @@ public function setToken(array $token): self {
    * @phpstan-return array<string, mixed>|null
    */
   private function getToken(bool $clear = FALSE): ?array {
-    $token = $this->session->get(self::SESSION_TOKEN);
+    $tokenKey = $this->getTokenKey();
+    $token = $this->session->get($tokenKey);
     if ($clear) {
-      $this->session->remove(self::SESSION_TOKEN);
+      $this->session->remove($tokenKey);
     }
 
     return $token;
@@ -535,4 +536,11 @@ private function getClaimKeys(): array {
     return $keys;
   }
 
+  /**
+   * Get unique token key.
+   */
+  private function getTokenKey(): string {
+    return self::SESSION_TOKEN . '_' . $this->getPluginId();
+  }
+
 }