JanssenProject / JanssenProject/jans
feat(jans-auth-server): introduce per tab session support for AS (via tab_id)
- Dominant language
- Java
- Stars
- 647
- Forks
- 173
- Avg merge
- 1d 18h
- Merged PRs (30d)
- 110
Description
### Description
Lets say we have scenario:
1. user1 logs in -> session1 is created
2. user2 hits authorization endpoint with `prompt=select_account` and gets logged in -> session2 is created.
```
session_id: de510ab6-b06c-4393-86d8-12a7c501aafe
current_sessions: ["de510ab6-b06c-4393-86d8-12a7c501aafe", "c691e83d-eb1b-41f0-b453-fab905681b5b"]
```
Only one session is active and in above scenario it will be user2.
**Goal** is to support in each tab own session. So end-user can have tab1 opened with user1 and tab2 with user2.
**Possible solution:**
We can introduce lets say tab_id and then SSO will work as combination of `session_id` and `tab_id`. `tab_id` is explicit request parameter and it will be stored in browser’s sessionStorage which is tab specific. So we need proper coding on front-channel pages and proper handling on AS endpoints. If `tab_id` is absent it will work as today (based on `session_id` cookie).

### Test cases and code coverage
- [ ] Write unit test to cover added/changed code
- [ ] Update integration tests to cover added/changed code
- [ ] documentation
Contributor guide
Assessment
This issue has not been assessed yet.