libre.sh/keycloak-scim
3
0
Fork 0
Code Issues 15 Pull requests Releases Packages Activity Actions

notes about access and refresh tokens

Browse source 
Closes #26919

Signed-off-by: AndyMunro <amunro@redhat.com>
This commit is contained in:
AndyMunro 2024-02-26 15:06:57 -05:00 committed by Alexander Schwartz
parent f1581adafe
commit 941e7cc3a5
1 changed files with 5 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
docs/documentation/securing_apps/topics/oidc/javascript-adapter.adoc
View file

@ -119,6 +119,11 @@ try {
const users = await fetchUsers();
----
[NOTE]
====
Both access and refresh token are stored in memory and are not persisted in any kind of storage. Therefore, these tokens should never be persisted to prevent hijacking attacks.
====
==== Session Status iframe
By default, the adapter creates a hidden iframe that is used to detect if a Single-Sign Out has occurred. This iframe does not require any network traffic. Instead the status is retrieved by looking at a special status cookie. This feature can be disabled by setting `checkLoginIframe: false` in the options passed to the `init()` method.