asgardeo / asgardeo/asgardeo-java-oidc-sdk

Add a new implementation for OIDC Manager with different storage mechanism instead of HTTP session

Open
#31 0 comments 0 reactions 0 assignees View on GitHub
Type/Improvement
Dominant language
Java
Stars
18
Forks
28
PR merge metrics
No merged PRs in 30d

Description

**Describe the issue:**
HTTP session-based OIDC processor has a limitation when the web app is deployed in more than one container.
Params such as nonce, state, and additional query params store in the session

1. https://github.com/asgardeo/asgardeo-java-oidc-sdk/blob/ac88bea2f289771f0aa9695180f6d662568e1057/io.asgardeo.java.oidc.sdk/src/main/java/io/asgardeo/java/oidc/sdk/HTTPSessionBasedOIDCProcessor.java#L66

and try to use them validate in the callback based on the session detail will be cause for issues if the callback doesn't come to the same container.
https://github.com/asgardeo/asgardeo-java-oidc-sdk/blob/ac88bea2f289771f0aa9695180f6d662568e1057/io.asgardeo.java.oidc.sdk/src/main/java/io/asgardeo/java/oidc/sdk/HTTPSessionBasedOIDCProcessor.java#L82

Enabling session affinity would be one solution, but not reliable because there could be container downtime.
Session replication is another option but the deployment will be complicated.

Contributor guide

No contributing guide indexed for this repository

Research direction

Start by reading HTTPSessionBasedOIDCProcessor.java at the referenced lines to understand how nonce, state, and additional query parameters are stored and validated. Determine the required alternative storage mechanism and define how callback validation should work across containers; the issue is complete when a new OIDC processor implementation removes the HTTP-session dependency without weakening validation.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
authentication
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.