Server-Side Sessions

Getting Started¶

1. Database schema

   Ensure your database is in the correct state. If you are coming from Duende IdentityServer, there is nothing further to do - the schema is already compatible. If you are migrating from IdentityServer4 and have not yet updated your schema to match the Open.IdentityServer schema, you will need to do this first. See migration from IdentityServer4 for details.

2. Enable server-side sessions

   Call .AddServerSideSessions() when configuring Open.IdentityServer:

   builder.Services.AddIdentityServer()
       .AddServerSideSessions();
   

3. Configure a session store

   AddServerSideSessions requires an implementation of IServerSideSessionStore to persist session data. If you are using Entity Framework Core, this is provided automatically when you configure the operational store:

   builder.Services.AddIdentityServer()
       .AddServerSideSessions()
       .AddOperationalStore(options =>
       {
           options.ConfigureDbContext = b =>
               b.UseSqlServer("ConnectionString");
       });
   

   If you are not using the built-in EF Core store, you will need to provide your own IServerSideSessionStore implementation.

5. (Optional) Configure additional session options

   You can customize behavior via ServerSideSessionOptions, such as how often sessions are checked for expiration in the background, or coordinating this with your sign-in cookie expiration:

   builder.Services.AddIdentityServer(options =>
   {
       // Other options...
       options.ServerSideSessions.ExpiredSessionsTriggerBackchannelLogout = true;
       options.ServerSideSessions.RemoveExpiredSessions = true;
       options.ServerSideSessions.RemoveExpiredSessionsFrequency = TimeSpan.FromSeconds(10);
       options.ServerSideSessions.FuzzExpiredSessionsFrequency = true;
       options.ServerSideSessions.RemoveExpiredSessionsBatchSize = 100;
   });
   

Management Interface¶

Open.IdentityServer has a built-in session management interface, ISessionManagementService, that allows you to query existing sessions and remove sessions. When you configure Open.IdentityServer to use server-side sessions, a default implementation is registered for this interface.

The interface provides two methods:

• Task<QueryResult<UserSession>> ISessionManagementService.QuerySessionsAsync(SessionQuery? filter, CancellationToken ct = default)

  Filters sessions using the SessionQuery object. The filter is optional; default values are used when it is not provided.

• Task ISessionManagementService.RemoveSessionsAsync(RemoveSessionsContext context, CancellationToken ct = default)

  Removes sessions using the RemoveSessionsContext object. The context allows you to control which sessions are removed and what actions are taken as part of the removal.

Data Types¶

The following types are used by ISessionManagementService to query and manage sessions.