Search code examples
.netitfoxtec-identity-saml2

How to refresh ITFoxtec SAML session in the background of React App with .NET webapi


I have a react frontend app with a .NET 6 Web API which is using ITFoxtec SAML library.

The authentication flow is as follows:

enter image description here

Calls from ClientApp to API (which include the SAML token using CORS) are successful for the duration of the initial 15 minute SAML session on the server side. After 15 minutes has elapsed, no matter how active the user was (numerous requests to API), the session times-out.

How can I indicate to the WebAPI that the user is active during each API requests? It seems like I need to update the SAML cookie that is being passed back and fourth somehow.


Solution

  • When the server receive the SAML 2.0 token, you can let the server validate the token and then forget about the token. Then you can let .NET handle the session security with cookies.

    It should work if you set the builder.Services.AddSaml2(slidingExpiration: true); if you in your case touch the badkend within 15 minuts.

    Alternatively, you can set a longer session timeput in the CreateSession method.