Summary of proposed feature
Add a way to pass session_state from identity provider response to jwt callback
Purpose of proposed feature
session_state parameter is a required part to use in check_session_iframe scenario. By forwarding it to the jwt callback it can be saved to client session and used in the browser to find out if identity session has changed
Detail about proposed feature
Minimal required change would probably be passing req.query.session_state to the jwt callback, although I'm not quite sure in which object or parameter it should be put
Potential problems
session_state is not useful for all scenarios and may not be supported by certain oidc providers
Describe any alternatives you've considered
Polling identity provider with prompt=none, but this causes extra network traffic
Polling introspection endpoint to find if access_token is still valid, but this requires using access_token and having access to introspection
Additional context
More info about oidc session management
Please indicate if you are willing and able to help implement the proposed feature.
I am willing to implement the feature, but I might require some additional guidance as to where to actually put the parameter
Summary of proposed feature
Add a way to pass
session_statefrom identity provider response to jwt callbackPurpose of proposed feature
session_stateparameter is a required part to use in check_session_iframe scenario. By forwarding it to the jwt callback it can be saved to client session and used in the browser to find out if identity session has changedDetail about proposed feature
Minimal required change would probably be passing
req.query.session_stateto the jwt callback, although I'm not quite sure in which object or parameter it should be putPotential problems
session_stateis not useful for all scenarios and may not be supported by certain oidc providersDescribe any alternatives you've considered
Polling identity provider with
prompt=none, but this causes extra network trafficPolling introspection endpoint to find if
access_tokenis still valid, but this requires usingaccess_tokenand having access to introspectionAdditional context
More info about oidc session management
Please indicate if you are willing and able to help implement the proposed feature.
I am willing to implement the feature, but I might require some additional guidance as to where to actually put the parameter