Identityserver4: connect/checksession API not returning changed event in iframe

[damienbod]

I'm testing the connect/checksession API as described here:

http://openid.net/specs/openid-connect-session-1_0.html

Even though my id_token and access_token have expired, the check_session iframe API always returns an unchanged event.

MessageEvent {isTrusted: true, data: "unchanged", origin: "https://localhost:44318", lastEventId: "", ...

IdentityServer4 : 1.5.1

[leastprivilege]

token lifetimes are unrelated.

This checks the authentication session - IOW if the user has a valid cookie with idsrv

[damienbod]

So I need to configure IdentityServer4 to create a cookie when the user logins using the OpenID Implicit Flow and set the lifetime of this cookie to a value smaller than the lifespan of the id_token

[leastprivilege]

The cookie always gets created - that's the "SSO session" with identityserver.

id_token lifetime is not important - id tokens are just the signed protocol response (only used to validate the authentication event and for a hint at logout time).

[damienbod]

Any examples how I can configure the SSO session with identityserver4?

[leastprivilege]

Basic settings like lifetime and sliding vs absolute can be configured on the options in ConfigureServices.

If you need more control, provide your own cookie middleware and tell us the name of it (also on the options)

[lock[bot]]

This thread has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs.