On Fri, 31 May 2019 at 12:37, Rainer Hoerbe <rainer at hoerbe.at> wrote: Looks right to me. btw, I think those diagrams are really helpful, thanks for making them ;) In general, no; it is there as part of the generic process (it does not specialize for the authn-request flow). But, one can use this to make some special things happen, ie use the cookie for feature flags. -- Ivan c00kiemon5ter Kanakarakis >:3