Skip to content

Expose session_state to allow checking identity session using iframe #1305

@nulladdict

Description

@nulladdict

Summary of proposed feature
Add a way to pass session_state from identity provider response to jwt callback

Purpose of proposed feature
session_state parameter is a required part to use in check_session_iframe scenario. By forwarding it to the jwt callback it can be saved to client session and used in the browser to find out if identity session has changed

Detail about proposed feature
Minimal required change would probably be passing req.query.session_state to the jwt callback, although I'm not quite sure in which object or parameter it should be put

Potential problems
session_state is not useful for all scenarios and may not be supported by certain oidc providers

Describe any alternatives you've considered
Polling identity provider with prompt=none, but this causes extra network traffic
Polling introspection endpoint to find if access_token is still valid, but this requires using access_token and having access to introspection

Additional context
More info about oidc session management

Please indicate if you are willing and able to help implement the proposed feature.
I am willing to implement the feature, but I might require some additional guidance as to where to actually put the parameter

Metadata

Metadata

Assignees

No one assigned

    Labels

    enhancementNew feature or request

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions