Session management

[kaputsyn]

Confirm you've already contributed to this project or that you sponsor it

• I confirm I'm a sponsor or a contributor

Version

7

Question

Hi! What about session management? Is it supported?
The spec says that OP MUST return session_state if it supports it. Do you know about successful cases of implementing it over openiddict?

[kevinchalet]

Hey,

Hi! What about session management? Is it supported?

Neither frontchannel logout nor session management are supported in OpenIddict due to their major downsides: these two features only work for webapp clients and the progressive ban of third-party cookies started a few years ago has broken them, as now mentioned in the specifications themselves:

Note that at the time of this writing, some User Agents (browsers) are starting to block access to third-party content by default to block some mechanisms used to track the End-User's activity across sites. Specifically, the third-party content being blocked is website content with an origin different that the origin of the focused User Agent window. Site data includes cookies and any web storage APIs (sessionStorage, localStorage, etc.).

This can prevent the ability for notifications from the OP at the RP from being able to access the RP's User Agent state to implement local logout actions. In particular, cookies and web storage APIs may not be available in the OP frame loaded in the RP context. The side effect here is that, depending on the used mechanism (cookies or web storage), the data needed to recalculate session_state might not be available. Cookie based implementations might then return changed for every single call, resulting in infinite loops of re-authentications. Therefore, deployments of this specification are recommended to include defensive code to detect this situation, and if possible, notify the End-User that the requested RP logouts could not be performed. The details of the defensive code needed are beyond the scope of this specification; it may vary per User Agent and may vary over time, as the User Agent tracking prevention situation is fluid and continues to evolve.

https://openid.net/specs/openid-connect-session-1_0.html#ThirdPartyContent

What scenario(s) did you want to use it for?

[kaputsyn]

I need to manage sessions of clients as separate entities different from general SSO cookie and ask to relogin if client initiated logout but not relogin other clients