Interface ISessionCoordinationService

Namespace

Fdyay.IdentityServer.Services

Assembly

Fdyay.IdentityServer.Core.dll

Ending a session is more than deleting a row, and this is the rest of it.

public interface ISessionCoordinationService

Remarks

A session that ends leaves two things behind: the clients that were signed in to it still believe they have a user, and the grants issued during it still work. Deleting the session row addresses neither — it only stops the cookie resolving. Separated from ISessionManagementService because the same follow-up is owed whether a session was revoked by an administrator or simply expired, and those arrive from different places.

In Core since 0.99.0, so the refresh-token service and the token validator here can ask ValidateSessionAsync(SessionValidationRequest, CancellationToken) — as Duende's do — without reaching up into the hosting layer. The implementation stays there, registered by AddServerSideSessions(); with none registered, nothing asks.

Methods

ProcessExpirationAsync(ServerSideSession, CancellationToken)

Cleans up after a session that has expired. Duende's.

Task ProcessExpirationAsync(ServerSideSession session, CancellationToken cancellationToken = default)

Parameters

session ServerSideSession

cancellationToken CancellationToken

Returns

Task

Remarks

The clients are told the session expired rather than that it was ended. Calls ProcessLogoutAsync(ServerSideSession, CancellationToken) unless implemented, so an implementation written before 0.129.0 keeps compiling and keeps cleaning up after expired sessions as it did.

ProcessLogoutAsync(ServerSideSession, CancellationToken)

Cleans up after a session that has been ended from outside the browser holding it.

Task ProcessLogoutAsync(ServerSideSession session, CancellationToken cancellationToken = default)

Parameters

session ServerSideSession

cancellationToken CancellationToken

Returns

Task

Remarks

Its caller here is ISessionManagementService.RemoveSessionsAsync, so the clients are told the session was terminated. Duende's of the same name is called at a browser's own sign-out instead; this server's sign-out notifies the clients itself and does not come through here.

ValidateSessionAsync(SessionValidationRequest, CancellationToken)

Whether a client's token may still be used, given the user's session here; and, while it may, the session slid forward by the use.

Task<bool> ValidateSessionAsync(SessionValidationRequest request, CancellationToken cancellationToken = default)

Parameters

request SessionValidationRequest

cancellationToken CancellationToken

Returns

Task<bool>

Remarks

Only a client that coordinates its lifetime with the session is asked about it — Client.CoordinateLifetimeWithUserSession, or the server-wide default — and for one that does, a token whose subject and session id match no unexpired session is refused. Duende 8.0.1's, measured.

Answers valid unless implemented, so an implementation written before 0.99.0 keeps compiling and keeps its meaning — it coordinated nothing then, and still does.