Skip to content

Ensure session lifetime coordination is invoked when a session expires#1784

Merged
josephdecock merged 1 commit intomainfrom
beh/cookie-exp-with-server-side-sessions-bug
Feb 11, 2025
Merged

Ensure session lifetime coordination is invoked when a session expires#1784
josephdecock merged 1 commit intomainfrom
beh/cookie-exp-with-server-side-sessions-bug

Conversation

@bhazen
Copy link
Contributor

@bhazen bhazen commented Feb 10, 2025

What issue does this PR address?
Scenarios can exist where session lifetime coordination is enabled but a session is expired and removed prior to the cleanup job running and processing that expiration. These changes account for that scenario and implement a workaround to detect when the dotnet cookie handler removes a session and triggers the session coordination service's processing of an expired session to ensure things such as backchannel logout and removal of grants.

Important: Any code or remarks in your Pull Request are under the following terms:

If You provide us with any comments, bug reports, feedback, enhancements, or modifications proposed or suggested by You for the Software, such Feedback is provided on a non-confidential basis (notwithstanding any notice to the contrary You may include in any accompanying communication), and Licensor shall have the right to use such Feedback at its discretion, including, but not limited to the incorporation of such suggested changes into the Software. You hereby grant Licensor a perpetual, irrevocable, transferable, sublicensable, nonexclusive license under all rights necessary to incorporate and use your Feedback for any purpose, including to make and sell any products and services.

(see our license, section 7)

@bhazen bhazen self-assigned this Feb 10, 2025
@bhazen bhazen requested a review from josephdecock as a code owner February 10, 2025 20:10
@bhazen bhazen force-pushed the beh/cookie-exp-with-server-side-sessions-bug branch from 8ac824d to 7748171 Compare February 10, 2025 20:10
@bhazen bhazen added area/products/is IdentityServer impact/non-breaking The fix or change is not a breaking one labels Feb 10, 2025
@bhazen bhazen force-pushed the beh/cookie-exp-with-server-side-sessions-bug branch 2 times, most recently from d9410e2 to abed8c2 Compare February 10, 2025 21:29
@bhazen bhazen force-pushed the beh/cookie-exp-with-server-side-sessions-bug branch from abed8c2 to e08ac15 Compare February 11, 2025 02:10
@bhazen bhazen force-pushed the beh/cookie-exp-with-server-side-sessions-bug branch from e08ac15 to e943fde Compare February 11, 2025 02:11
@josephdecock josephdecock merged commit 5720ff1 into main Feb 11, 2025
4 checks passed
@josephdecock josephdecock deleted the beh/cookie-exp-with-server-side-sessions-bug branch February 11, 2025 16:05
@josephdecock josephdecock linked an issue Mar 20, 2025 that may be closed by this pull request
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

area/products/is IdentityServer impact/non-breaking The fix or change is not a breaking one

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Persistent cookies and server side sessions.

3 participants