Class AuthenticationOptions

Namespace

Fdyay.IdentityServer.Configuration

Assembly

Fdyay.IdentityServer.Core.dll

The session cookie's policy, and the cookies this server writes itself.

public sealed class AuthenticationOptions

Inheritance

object

AuthenticationOptions

Inherited Members

object.Equals(object)

object.Equals(object, object)

object.GetHashCode()

object.GetType()

object.ReferenceEquals(object, object)

object.ToString()

Remarks

The session cookie's lifetime, sliding expiration and SameSite mode are Duende's options here since 0.101.0, at Duende's defaults, read where Duende reads them: when the session cookie's CookieAuthenticationOptions are configured, and — sliding — when a client's token slides a server-side session. Until then they were declined as a second source of truth for values ASP.NET Core owns; parity took them. What made the refusal reasonable still holds: they are applied as configuration, so a host that sets the scheme's own options after AddIdentityServer() still wins, and a test still says so.

The check-session cookie is the other case. SessionStateService writes it with Response.Cookies.Append, so no options system reaches it at all, and its name was a constant read at four sites — one of them inside the JavaScript the check-session iframe runs. Two identity servers on one registrable domain wrote the same cookie and each saw the other's browser state.

Its SameSite mode is deliberately not here, and the reason is a limitation worth stating rather than a knob worth adding. The cookie is written SameSite=None with Secure, because the iframe runs in the relying party's page and reads it from a third-party context. Over plain HTTP the browser drops it whatever SameSite says — so an option here would not make check-session work in an HTTP development setup; it would take relaxing Secure as well, on a cookie, which is not a setting this server is going to offer. Check-session does not work over plain HTTP, and that is the honest sentence. A single option would have read like a fix for it.

Properties

CheckSessionCookieDomain

The domain to scope the check-session cookie to, or null to leave it host-only.

public string? CheckSessionCookieDomain { get; set; }

Property Value

string

Remarks

Null rather than a computed value: host-only is the narrower default, and a host that needs the iframe reachable from a sibling subdomain is making a deliberate widening it should have to write down.

CheckSessionCookieName

The name of the cookie the check-session iframe reads. Defaults to idsrv.session.

public string CheckSessionCookieName { get; set; }

Property Value

string

Remarks

Read by the service that writes the cookie and substituted into the script that reads it. Those are the two halves, and honouring one without the other would leave an iframe polling a cookie name nothing writes — a session that never appears to change, which a relying party cannot tell apart from a session that is simply still valid.

CookieAuthenticationScheme

The cookie scheme that holds a user's session here. When not set, the host's default authenticate scheme — and when there is none, DefaultCookieAuthenticationScheme if it is registered.

public string? CookieAuthenticationScheme { get; set; }

Property Value

string

Remarks

Duende 8.0.1's, measured: what a host sets when its default authentication scheme is a policy scheme, or its own cookie, so this server reads, writes and ends the session where the host's sign-in put it. A scheme named here that is not registered is refused at startup. Since 0.107.0; until then idsrv was hard-coded at about fifteen sites, a few of which consulted the default scheme first and the rest did not.

CookieLifetime

How long the session cookie lasts. Defaults to 10 hours, as in Duende.

public TimeSpan CookieLifetime { get; set; }

Property Value

TimeSpan

CookieSameSiteMode

The SameSite mode of the session cookie and the external sign-in cookie. Defaults to None, as in Duende, which sends them on cross-site requests and so needs HTTPS.

public SameSiteMode CookieSameSiteMode { get; set; }

Property Value

SameSiteMode

CookieSlidingExpiration

Whether the session cookie's expiry moves with use. Defaults to false, as in Duende: a session ends CookieLifetime after sign-in however active it was.

public bool CookieSlidingExpiration { get; set; }

Property Value

bool

Remarks

Also what lets a coordinating client's token renew the cookie's own ticket when it slides a server-side session; without it only the session's row slides.

CoordinateClientLifetimesWithUserSession

Whether every client's tokens live only as long as the user's session here, unless the client says otherwise with Client.CoordinateLifetimeWithUserSession. Defaults to false, as in Duende.

public bool CoordinateClientLifetimesWithUserSession { get; set; }

Property Value

bool

RequireAuthenticatedUserForSignOutMessage

Whether an end-session request from a user with no session here has its parameters ignored — id_token_hint, post_logout_redirect_uri and state. Off by default, as in Duende.

public bool RequireAuthenticatedUserForSignOutMessage { get; set; }

Property Value

bool

RequireCspFrameSrcForSignout

Whether the signed-out page, which loads each client's front-channel logout URL in an iframe, carries a Content-Security-Policy whose frame-src names those clients' origins. On by default, as in Duende.

public bool RequireCspFrameSrcForSignout { get; set; }

Property Value

bool

Remarks

Duende 8.0.1's, measured: when off, that page carries no policy at all. When on — and until 0.106.0 there was no choice — the page has this library's interactive-page policy; until 0.106.0 that policy had no frame-src, so default-src 'none' blocked every one of the page's iframes in a browser.