Unverified50% confidenceCautionExact time
If an application only listens for DELETE requests while the IdP actually sends a PATCH with active=false, deactivated users may still retain system access, posing a security risk.
1
Sources
50%
Confidence
Long-term
Relevance
9/12/2026
First Seen
Sources
Related Entities
Related Claims
UnverifiedNot all identity directories proactively send deprovisioning events; some IdPs do not send a separate user-level deprovisioning request when a user is removed from a group or has their application assignment revoked.70% similarUnverifiedBack-channel logout relies on HTTP POST requests; if an RP endpoint is unreachable, the logout notification fails, and the specification recommends that IdPs implement a retry mechanism but does not mandate it.67% similarUnverifiedBrowser extensions for ad blocking, privacy protection, and script management may intercept critical requests during the OAuth authorization redirect process, causing connection failures.66% similarUnverified规避Cursor封号风险的核心在于不篡改客户端、不做接口中转，采用原生调度方式保持客户端原生纯净65% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/910717API
curl https://kongchang.com/api/v1/knowledge/claims/910717MCP
get_claim(id=910717)