JanssenProject / JanssenProject/jans

feat(jans-auth-server): introduce per tab session support for AS (via tab_id)

Open
#10,921 0 comments 0 reactions 1 assignee Claimed by @yuriyz View on GitHub
comp-jans-auth-server kind-feature
Dominant language
Java
Stars
647
Forks
173
Avg merge
1d 18h
Merged PRs (30d)
110

Description

### Description

Lets say we have scenario:
1. user1 logs in -> session1 is created
2. user2 hits authorization endpoint with `prompt=select_account` and gets logged in -> session2 is created.

```
session_id: de510ab6-b06c-4393-86d8-12a7c501aafe
current_sessions: ["de510ab6-b06c-4393-86d8-12a7c501aafe", "c691e83d-eb1b-41f0-b453-fab905681b5b"]
```

Only one session is active and in above scenario it will be user2.

**Goal** is to support in each tab own session. So end-user can have tab1 opened with user1 and tab2 with user2.

**Possible solution:**
We can introduce lets say tab_id and then SSO will work as combination of `session_id` and `tab_id`. `tab_id` is explicit request parameter and it will be stored in browser’s sessionStorage which is tab specific. So we need proper coding on front-channel pages and proper handling on AS endpoints. If `tab_id` is absent it will work as today (based on `session_id` cookie).

![Image](https://github.com/user-attachments/assets/a6a9125c-8448-4168-9e46-07252f152a32)

### Test cases and code coverage

- [ ] Write unit test to cover added/changed code
- [ ] Update integration tests to cover added/changed code
- [ ] documentation

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.