Cookie Renewal for SBL cookie #1335
Labels
area/authentication
Area: Issues related to authentication in Altinn Studio
Epic
Used by zenhub to identify the epics that group issues.
kind/user-story
Used for issues that describes functionality for our users.
Milestone
Description
When a user is logged in to Altinn and access Altinn Apps / Altinn Platform the forms authentication cookie (.aspxauth) used in the old platform will not be refreshed.
A user can experience that he is logged out when he redirects back to messagebox even he has been active all the time.
To prevent this SBL needs to authenticate the forms authentication cookie based on the altinnstudioruntime cookie.
The Altinn Studio runtimecookie contains a JWT token. That token will be refreshed while user is using Altinn Apps or Altinn Platform.
The proposed solutions it that when a user is redirected to login page in SBL portal, that SBL page needs to verify if there exist a valid JWT cookie and if so generate a new .aspxauth cookie based on the claims in the JWT token.
We need to create a mechanismen to update the SBL cookie when the JWTCookie is refreshed/created and update through the JWTCookie refresh endpoint #1718
Acceptance criterea
The text was updated successfully, but these errors were encountered: