I understand that the idsrv.session cookie is used to detect whether or not a user's session has changed. This cookie is part of the the OIDC Session Management implementation that is provided in IdentityServer. What I then don't understand is what the idsrv cookie is used for. Can someone please explain?
In IdentityServer4 what is the difference between the 'idsrv' and the 'idsrv.session' cookie?
Viewed 9957
2 Answers
The idsrv cookie is used for ASP.NET Core Cookie Authentication.
See http://docs.identityserver.io/en/release/topics/signin.html
IdentityServer registers two cookie handlers (one for the authentication session and one for temporary external cookies). These are used by default and you can get their names from the IdentityServerConstants class (DefaultCookieAuthenticationScheme and ExternalCookieAuthenticationScheme) if you want to reference them manually.
DefaultCookieAuthenticationScheme value is 'idsrv'
The .session cookie is only used by the session monitoring endpoint to detect if the current session has changed. You’ll notice that it is not set as HTTP only and thus can be accessed by script run by that endpoint. It is not the authentication cookie.
Related