Class SessionRevokedEvent

Namespace

Fdyay.IdentityServer.Events

Assembly

Fdyay.IdentityServer.Core.dll

A session was ended by somebody other than the person holding it.

public class SessionRevokedEvent : Event

Inheritance

object

Event

SessionRevokedEvent

Inherited Members

Event.Category

Event.Name

Event.EventType

Event.Id

Event.Message

Event.TimeStamp

Event.ActivityId

Event.RemoteIpAddress

Event.LocalIpAddress

Event.ProcessId

Event.PrepareAsync()

Event.ToString()

object.Equals(object)

object.Equals(object, object)

object.GetHashCode()

object.GetType()

object.MemberwiseClone()

object.ReferenceEquals(object, object)

Remarks

What ISessionManagementService.RemoveSessionsAsync does, which is the seam a host builds an administrative surface out of: ending a session from outside the browser holding it. Until 0.57.0 the row was deleted, the grants revoked and the relying parties notified, and the host was told nothing — so the one action on this server that an operator is most likely to be asked to account for afterwards left no record of having happened.

Deliberately not UserLogoutSuccessEvent, and deliberately not SessionExpiredEvent either. A sign-out is a person's own decision; this is somebody else's decision about them; an expiry is nobody's. They differ in what an operator does about a rise in the count — nothing, a security response, or a session lifetime that wants looking at — and a host keys its alerting on EventIds, so folding them together behind a reason field would put the distinction somewhere no alert rule can reach.

One per session, not per call. A filter may match several, and "three of this user's sessions were ended" is not the same fact as "a session was ended" — the same reasoning BackChannelLogoutFailureEvent is one per relying party for.

Constructors

SessionRevokedEvent(string?, string?)

A session ended by somebody other than the person holding it.

public SessionRevokedEvent(string? subjectId, string? sessionId)

Parameters

subjectId string

Whose session it was, or null where the stored row carried no subject.

sessionId string

The session that ended, or null where the row named none.

Properties

SessionId

The session that ended — what a relying party keys its own cleanup on.

public string? SessionId { get; }

Property Value

string

Remarks

Nullable because the row may carry none, and a session with no sid is exactly the one DefaultSessionCoordinationService declines to clean up after: there is nothing to scope the revocation or the notification to. The event is still raised, because the row was still deleted.

SubjectId

Whose session it was. Null where the stored row carried no subject.

public string? SubjectId { get; }

Property Value

string