My setup includes an Identity server 4 application, several asp .net core applications, and a Javascript application. I've enabled back channel logout on the asp .net core applications to ensure that when one application logs out, they are all logged out almost instantly.
The problem arises with the JavaScript application, which needs to constantly poll the identity server every minute to check if the user is still logged in. This becomes crucial in financial applications where users need to be logged out of all platforms when they leave their desk.
Imagine a scenario where a user is logged into Asp .net core app 1, Asp .net core app 2, and the Javascript app via tokens from the identity server. When the user logs out of Asp .net core app 1 triggering the back channel logout, it also logs out of Asp .net core app 2. However, the JavaScript app needs manual intervention to sign out the user, which involves continuous polling of the identity server for authentication status.
JavaScript timer
To accomplish this, I have set up a timer that runs every second to call the identity server.
setInterval(myTimer, 1000);
function myTimer() {
mgr.getUser().then(function (user) {
var url = config.authority + "/api/user/LoggedIn";
var xhttp = new XMLHttpRequest();
xhttp.onreadystatechange = function () {
if (this.readyState == 4 && this.status == 200) {
alert(this.responseText);
}
};
xhttp.open("GET", url);
xhttp.setRequestHeader("Authorization", "Bearer " + user.access_token);
xhttp.send();
});
}
Identity server endpoint
I've created an API endpoint on the identity server to verify user authorization.
[Route("api/[controller]")]
[ApiController]
public class UserController : ControllerBase
{
[HttpGet("LoggedIn")]
public IActionResult LoggedIn()
{
return Ok(new { IsLoggedIn = User.Identity.IsAuthenticated });
}
}
However, the issue lies in the fact that this API endpoint fails to correctly load user identity information, showing User.Identity.IsAuthenticated as false even when the user is logged in on the identity server.
How can I accurately determine if the user is still authenticated on the identity server? Is there a more effective endpoint that already provides this information? The userinfo endpoint returns true regardless of the user's actual status. Is there no direct way to check the auth session on the identity server itself from JavaScript?