Class InMemorySessionStore

Namespace

Tessio.Verifier.AspNetCore

Assembly

Tessio.Verifier.AspNetCore.dll

Default in-memory ISessionStore. Suitable for a single-process app, the demo, and tests. Production deployments swap in a distributed store (Redis, SQL, …).

public sealed class InMemorySessionStore : ISameDeviceSessionStore, IStateCorrelatingSessionStore, IAttemptRecordingSessionStore, ISessionStore

Inheritance

object

InMemorySessionStore

Implements

ISameDeviceSessionStore

IStateCorrelatingSessionStore

IAttemptRecordingSessionStore

ISessionStore

Inherited Members

object.Equals(object)

object.Equals(object, object)

object.GetHashCode()

object.GetType()

object.ReferenceEquals(object, object)

object.ToString()

Constructors

InMemorySessionStore(IPresentationRequestBuilder, TimeProvider)

Creates the store.

public InMemorySessionStore(IPresentationRequestBuilder requestBuilder, TimeProvider clock)

Parameters

requestBuilder IPresentationRequestBuilder

clock TimeProvider

Methods

CompleteAsync(string, VerificationResult, CancellationToken)

public Task CompleteAsync(string sessionId, VerificationResult result, CancellationToken ct = default)

Parameters

sessionId string

result VerificationResult

ct CancellationToken

Returns

Task

CreateAsync(PresentationRequestOptions, CancellationToken)

public Task<VerificationSession> CreateAsync(PresentationRequestOptions options, CancellationToken ct = default)

Parameters

options PresentationRequestOptions

ct CancellationToken

Returns

Task<VerificationSession>

CreateBoundAsync(PresentationRequestOptions, byte[], CancellationToken)

Creates a session, as CreateAsync(PresentationRequestOptions, CancellationToken) does, bound to the browser whose binding hash is browserBinding.

public Task<VerificationSession> CreateBoundAsync(PresentationRequestOptions options, byte[] browserBinding, CancellationToken ct = default)

Parameters

options PresentationRequestOptions

browserBinding byte[]

ct CancellationToken

Returns

Task<VerificationSession>

FindByStateAsync(string, CancellationToken)

Finds the pending session whose presentation request carries state, or null when no such session exists (unknown, evicted, or replayed state).

public Task<VerificationSession?> FindByStateAsync(string state, CancellationToken ct = default)

Parameters

state string

ct CancellationToken

Returns

Task<VerificationSession>

GetAsync(string, CancellationToken)

public Task<VerificationSession?> GetAsync(string sessionId, CancellationToken ct = default)

Parameters

sessionId string

ct CancellationToken

Returns

Task<VerificationSession>

HoldAsync(string, VerificationResult, byte[], DateTimeOffset, CancellationToken)

Holds a verified result for a bound session until redeemBy, leaving the session Pending. The callback asks this for every verified presentation, cross-device ones included, because the binding is one of the two marks of a same-device session.

public Task<SameDeviceHold> HoldAsync(string sessionId, VerificationResult result, byte[] responseCodeHash, DateTimeOffset redeemBy, CancellationToken ct = default)

Parameters

sessionId string

result VerificationResult

responseCodeHash byte[]

redeemBy DateTimeOffset

ct CancellationToken

Returns

Task<SameDeviceHold>

NotBound for a session the store holds no binding for, whatever its state, so that asking about a cross-device session changes nothing; NotPending when the session is unknown, or is bound and has ended or already holds an unexpired presentation.

Remarks

Only a verified presentation is held. A failing one that arrives while another is held is refused under the usual rule, so without CompleteOnlyOnValidResponse it ends the session and the held presentation with it. Only the holder of the request's state can send one, and a session ended early is a refusal, never a wrong verdict.

RecordFailedAttemptAsync(string, VerificationResult, CancellationToken)

Records failure as the session's LastFailure and increments FailedAttempts, leaving the session Pending. Does nothing when the session is no longer pending, so a failure that loses a race with a valid response cannot overwrite it.

public Task RecordFailedAttemptAsync(string sessionId, VerificationResult failure, CancellationToken ct = default)

Parameters

sessionId string

failure VerificationResult

ct CancellationToken

Returns

Task

RedeemAsync(string, byte[], byte[], CancellationToken)

Redeems the held presentation whose response code hashes to responseCodeHash. When browserBinding matches the session's binding, completes the session with the held result in the same step. When it does not, discards the held result and leaves the session pending for the caller to reject. A browser that sent no cookie is passed a hash nothing was ever bound to.

public Task<SameDeviceRedemption> RedeemAsync(string sessionId, byte[] responseCodeHash, byte[] browserBinding, CancellationToken ct = default)

Parameters

sessionId string

responseCodeHash byte[]

browserBinding byte[]

ct CancellationToken

Returns

Task<SameDeviceRedemption>