Expired server side sessions not deleted immediately #356
Unanswered
goncalo-silva-prt
asked this question in
IdentityServer
Replies: 1 comment 5 replies
-
Thank you for raising this issue. We will follow up with the product team and get back to you. |
Beta Was this translation helpful? Give feedback.
5 replies
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Uh oh!
There was an error while loading. Please reload this page.
-
I’m using server-side sessions in both IdentityServer (ServerSideSessions.RemoveExpiredSessions and ServerSideSessions.RemoveExpiredSessions are both enabled) and IdentityServer.BFF. I’ve noticed an issue related to session expiration and cleanup.
There seems to be a time window between when a session expires and when the cleanup job runs. During this period:
My expectation is that once the session is expired, it should be deleted and the backchannel logout should be triggered immediately (as described here).
In particular, I would expect that when DefaultSessionCoordinationService.ValidateSessionAsync detects that a session is invalid, it should also trigger the deletion process (and consequently backchannel logout), instead of relying on the cleanup job to run later.
I am aware that I could override ValidateSessionAsync to implement custom behavior, but I want to make sure I’m not missing any configuration or built-in mechanism.
Beta Was this translation helpful? Give feedback.
All reactions