Is it real to fork current user session?
For example:
We have domain.com with currently implemented authentication by AWS Cognito service with Amplify SDK on the client.
And now we have to move some big part of functional to subdomain sub.domain.com.
The main questions are:
- can we have single
signInplace atdomain.comfor both domains and just implement something like a session fork forsub.domain.com(cause if we will just share the same session between domain and subdomain there are some issues might be withrefeshToken, cause it's disposable) - what is the best way to share sensitive data between domain and subdomain?
UPD: I'd try to explain more clear the logic that I have to implement
- there are two clients:
domain.com(already exists) andsub.domain.com(the last one will be) - authentication is handled by
AWS Cognitoat back andAmplify SDKat front domain.comandsub.domain.comhave to share the sameUserPoolandUserPoolClient- both clients have to communicate with the same endpoints which auth is required
- client at
sub.domain.commustn't have asignInorsignUpfunctioanlity - but client at
sub.domain.comstill have to maintain and update the session (bacause of 4 step) - so business wanna something like this behaviour:
- if you go to
sub.domain.comand you are already logged in atdomain.com, everything is fine (user profile/some private data is shared between these two apps) and user can use app atsub.domain.com - if a user open
sub.domain.combut he isn't authorized already atdomain.com, app atsub.domain.comhave to detect this and notify user that he have to authorize atdomain.comat first. And after user did this,sub.domain.comwill automaticaly get session fromdomain.com
- if you go to
- BUT, if we just share the same session/data from localstorage between two apps, we will have potential issues with refreshing/handling tokens
So, is there might be some various of implementation of this logic such as session fork, or something like that?