5 documents tagués avec "session-management"

Operational guidance for integrating with LuxID: timeouts, retries and backoff, idempotency, JWKS caching, and how to behave during a LuxID outage.

Core identity concepts and the LuxID domain model you need before writing any integration code.

Architectural decisions to make before writing production code: protocol, required auth_level, MFA, Sphere, session strategy, logout, and branding.

How to persist refresh tokens, silently renew sessions, and avoid re-prompting users for credentials and OTP on every app restart.

Revoke refresh tokens or access tokens programmatically using the RFC 7009 revocation endpoint, and understand the relationship with user-initiated revocation.