Class ServerSideSessionCleanup

Namespace

Fdyay.IdentityServer.Services

Assembly

Fdyay.IdentityServer.AspNetCore.dll

Removes server-side sessions that have expired, and cleans up after each one.

public sealed class ServerSideSessionCleanup

Inheritance

object

ServerSideSessionCleanup

Inherited Members

object.Equals(object)

object.Equals(object, object)

object.GetHashCode()

object.GetType()

object.ReferenceEquals(object, object)

object.ToString()

Remarks

A session row is written on sign-in and deleted on sign-out. A user who simply closes the browser signs out of nothing, so without this the row outlives the session forever: the table grows without limit, and — the consequence that matters more — every relying party the user was signed in to keeps its own local session, believing a session that ended hours ago is still live.

Separate from Fdyay.IdentityServer.Services.ServerSideSessionCleanupHostedService for the same reason TokenCleanup is separate from its hosted service: the sweep is a method that can be called and asserted on, and the interval loop around it is not.

Constructors

ServerSideSessionCleanup(IServerSideSessionStore, ISessionCoordinationService, IEventService, ILogger<ServerSideSessionCleanup>)

Creates the sweep, as the container resolves it.

public ServerSideSessionCleanup(IServerSideSessionStore store, ISessionCoordinationService coordination, IEventService events, ILogger<ServerSideSessionCleanup> logger)

Parameters

store IServerSideSessionStore

The server-side sessions, from which expired ones are taken and removed.

coordination ISessionCoordinationService

Cleans up after each expired session: its clients told it expired, its grants removed.

events IEventService

Receives a SessionExpiredEvent for each expired session.

logger ILogger<ServerSideSessionCleanup>

Receives a cleanup that failed and a sweep that stopped at its batch limit.

Fields

BatchSize

How many expired sessions one round of the sweep pulls back at a time.

public const int BatchSize = 100

Field Value

int

Remarks

Bounded so a server that has not swept in a long time cannot pull every expired session into memory at once. A fixed constant rather than an option: ServerSideSessions is absent from the options surface by choice — the feature is an opt-in registration rather than a flag — and adding a group to carry a sweep interval would change that for a number no host has a reason to tune.

Methods

RemoveExpiredSessionsAsync(CancellationToken)

Removes every expired session, notifying the clients of each, and returns how many went.

public Task<int> RemoveExpiredSessionsAsync(CancellationToken cancellationToken = default)

Parameters

cancellationToken CancellationToken

Returns

Task<int>