13L/ Browser APIs to enable OpenID Session Management and Privacy

From IIW

Browser APIs to Enable OpenID Session Management and Privacy

Wednesday 13L

Convener: Sam Goto

Notes-taker(s): Kristina Yasuda

Tags for the session - technology discussed/ideas considered:

OpenID Connect, Browser, session management, privacy, logout

Discussion notes, key understandings, outstanding questions, observations, and, if appropriate to this discussion: action items, next steps: 

How does logout in OIDC happen?

  • More flexibility on the endpoint; additional log out

  • <img> is for WS-Fed

  • Possible for a browser to look at a redirect and classify it as RP-initiated logout?

    • Probably - look at the message structure, if knew endpoints

    • In the OpenID Config file. .well-known location

    • Do discovery, out of config piece identify endpoint, match and identify it is a logout call

    • More signals the browser can observe, more of user-intent it can catch and can provide identity centric flow

  • Cannot observe as IdPs load iFrames to logout users

  • Variety of mechanisms for starting the logout flows from the RP to the IdP

    • No affordance defined how the user would initiate

    • RP/Application decides what experience it wants to offer to the user

[[File:./media/image1.png|624x353px]]

  • Classification problem - browsers do not know it is a logout now

  • Easiest way

    • Browser asks for a user consent

    • Hard from a permission implementation perspective

    • Tim: No issues with this idea

    • If user logged into several OPs, user will not look to all the ones they log out from

  • Option2

    • Browser classifies signing-in event

    • On log out does not prompt the user and IdP has no incentives to lie

  • RPs get to determine if they want to log the user out or not

  • Whether you can swap generic frame with fenced frame, frame can see it’s own cookies

  • What needs more to be discussed what log out means to the user

    • User does not understand when they log out from office, they also log out from Azure

    • Also a developer choice

    • Relevant one, but not much browsers can do about

    • If a bigger picture is browser wants to be in the middle, browser can do something in this area too.

  • Ugly part of logout - mechanisms to allow the range of services

    • IdP does not need to send back list of all RPs user is logging out from

  • Idea not entirely off for IdP to tell a browser from there it wants to log user out from

    • Browser have confident of the user intent

    • Prompt the user for the intent - never a good idea

  • Logout API that community can control a behaviour of

    • You call it, browser logs it, and tell where the user left of

    • Browser observes the login - passively. Heuristics - what if the browser has not seen it..

  • some of this is already starting to show up in chrome canarie

  • If domain name ETLD of the issuer is the same as IdP, automatically logs out

  • Logout seemed natural, but what else in session management will break?

    • Background refresh of tokens - viable alternative to use refresh tokens

    • Using iframe to extend lifetime of sessions - touching and moving it

    • Nonce - trying to prevent forgery; create some transient stuff - solution to do self 200

    • Account chooser: 5 possible IdPs, remembers last ones remembered - might become impossible

  • First party state? Wrt nonce, cookies will be blocked even if it looks first party

    • Classification of sign-in, where user have valid endpoints, nonce case

    • Nonce cookie should be classified samesite=none?

    • If today you do above they will work, but samsite=none goes away, and with lax that is left, but with lax it will break because user did not explicitly ask for it

  • Are samsite=none and samesite cookie not the same?

    • Top of navigation or not is about lax?

    • Cookie on top level navigation will continue

    • Lax requires explicit user action

    • samesite=lax will send a cookie but not with POST, nothing that implies first vs third party; not a defined set of restrictions.

  • Can you send me the list of what you are not finding alternatives for? Will happen in Tim-Heather discussion context

    • Only one with an alternative is out-of-band renewal of tokens

  • Looks like we can preserve session management if we figure out logout

  • AOB? At IIW?

    • Understand what third party cookies actually mean - no cookies at all? Partition cookies going away. The way firefox is doing it?

Retrieved from "https://iiw.idcommons.net/index.php?title=13L/_Browser_APIs_to_enable_OpenID_Session_Management_and_Privacy&oldid=23709"