added some more todos

auth/oidc.go

@@ -109,6 +109,7 @@ func (b *OIDCBackend) HandleLogin(w http.ResponseWriter, r *http.Request) {
 		http.Error(w, "Failed to generate new OIDC session: "+err.Error(), http.StatusInternalServerError)
 		return
 	}
+	// TODO: this session should expire in ~a minute
 	s = &Session{oidc: os}
 	if sid, err = auth.sessions.insert(s); err != nil {
 		http.Error(w, "Failed to generate new session: "+err.Error(), http.StatusInternalServerError)
@@ -186,6 +187,7 @@ func (h *oidcCallbackHandler) ServeHTTP(w http.ResponseWriter, r *http.Request)
 		http.Error(w, err.Error(), http.StatusInternalServerError)
 		return
 	}
+	// TODO: extend this to MaxAge to make short lived initial sessions possible
 	newS.Expires = s.Expires
 	newS.oidc = &OIDCSession{State: s.oidc.State, Nonce: s.oidc.Nonce}
 	newS.oidc.token = oauth2Token