​Hi Community,

We are on ISAM 9.0.5

Context:

We have a mobile app for wich we implemented OAuth for the access to our ressources.

This app needs to switch the user to a web browser in some cases (dev team did not have time te rewrite everything natively, so part is still using the web app).

For this we activated the session end-point so that the app could exchange its access_token for a session cookie that the browser uses for authentification.

My question:

After having called the session end point & given the session cookie to the browser, what if the app goes through a refresh_token workflow to obtain a new set of tokens?

Will that automatically invalidate the session cookie established with the previous access_token? or would the session cookie continue to be valid until its "natural" expiration?

My best guess is that it continues to be valid: I doubt that the Reverse Proxy, once it has a valid session cookie, has a process to verify that the access_token that was used to generate that cookie is still valid.

But would like a confirmation just to be absolutely certain.

Many Thanks,
Louis

------------------------------
Louis Beaudry
Access Management
Intact Financial Corporation
------------------------------

Hi Louis, 

You are correct, once the session is created in WebSEAL it wont call back to check if the access_token is still valid. Performing a refresh flow will not invalidate the WebSEAL session. 

Thanks

------------------------------
Leo Farrell
------------------------------