AM 7.2.1

Client-side sessions

Client-side sessions are those where AM returns session state to the client after each request, and require it to be passed in with the subsequent request.

Some features are not supported in realms configured for client-side sessions. For more information, see Limitations of using client-side sessions.

You should configure AM to sign and/or encrypt client-side sessions and client-side authentication sessions for security reasons. As decrypting and verifying the session may be an expensive operation to perform on each request, AM caches the decrypt sequence in memory to improve performance.

For information about configuring AM with sticky load balancing, see Load balancing.

For more information about configuring client-side security, see Client-side session security.

  • Client-side authentication sessions

    Client-side authentication sessions are supported for authentication trees only, and are configured by default in new installations.

    During authentication, the authentication session state is returned to the client after each call to the authenticate endpoint and stored in the authId object of the JSON response.

    After the authentication flow has completed, if the realm to which the user has authenticated is configured for server-side sessions, AM creates the user’s session in the CTS token store. Then, AM attempts to invalidate the client-side authentication session.

    Storing authentication sessions on the client allows any AM server to handle the authentication flow at any point in time without load balancing requirements.

    Authentication session allowlisting is an optional feature that maintains a list of in-progress authentication sessions and their progress in the authentication flow to protect against replay attacks. For more information, see Authentication session allowlisting.

  • Client-side sessions

    For browser-based clients, AM sets a cookie in the browser that contains the session state. When the browser transmits the cookie back to AM, AM decodes the session state from the cookie. For REST-based clients, AM sends the cookie in a header. For more information about session cookies, see Session cookies and session security.

    Session denylisting is an optional feature that maintains a list of logged out client-side sessions in the CTS token store. For more information about session termination and session denylisting, see Session termination.

Related information: Choose where to store sessions

Copyright © 2010-2023 ForgeRock, all rights reserved.