Class ServerSideSessionExtensions

Namespace: Fdyay.IdentityServer.Configuration

Assembly: Fdyay.IdentityServer.AspNetCore.dll

Opt-in server-side sessions.

public static class ServerSideSessionExtensions

Inheritance: object

ServerSideSessionExtensions

Inherited Members: object.Equals(object)

object.Equals(object, object)

object.GetHashCode()

object.GetType()

object.MemberwiseClone()

object.ReferenceEquals(object, object)

object.ToString()

Methods

AddServerSideSessions(IServiceCollection)

Keeps the authentication ticket on the server and puts a key in the cookie, so a session can be listed and ended from outside the browser holding it.

public static IServiceCollection AddServerSideSessions(this IServiceCollection services)

Parameters

services IServiceCollection

Returns

IServiceCollection

Remarks

Opt-in rather than on by default, and the reason is the storage. Every signed-in browser becomes a row that has to be written on sign-in, read on every request, and swept when it expires — a real cost, and one a host running a single instance with no administrative session screen has no reason to pay. The default in-memory store makes that trade worse rather than better in production, which is why a host registering its own IServerSideSessionStore first keeps it.

The sweep runs here, as a hosted service, and that is worth one note: it has no request to derive an issuer from, so the back-channel logout notifications it sends need IssuerUri configured. Without it the sessions are still removed and their grants revoked, and a warning says the clients were not told.