Revert "Implement OIDC session management"

This reverts commit a1e4248.

samples/Contruum/Contruum.Server/Handlers.cs

@@ -1,12 +1,6 @@
-using System;
-using System.Globalization;
-using System.Security.Cryptography;
-using System.Text;
+using System.Globalization;
 using System.Text.Json;
 using System.Threading.Tasks;
-using Microsoft.AspNetCore;
-using Microsoft.AspNetCore.Authentication;
-using Microsoft.Extensions.Configuration;
 using OpenIddict.Abstractions;
 using OpenIddict.Server;
 using static OpenIddict.Abstractions.OpenIddictConstants;
@@ -61,46 +55,4 @@ public ValueTask HandleAsync(HandleUserinfoRequestContext context)
             return default;
         }
     }
-
-    public class AttachCheckSessionIframeEndpoint : IOpenIddictServerHandler<HandleConfigurationRequestContext>
-    {
-        private readonly IConfiguration _configuration;
-
-        public AttachCheckSessionIframeEndpoint(IConfiguration configuration)
-        {
-            _configuration = configuration;
-        }
-
-        public ValueTask HandleAsync(HandleConfigurationRequestContext context)
-        {
-            var baseUri = context.BaseUri ?? throw new InvalidOperationException("Missing BaseUri");
-            var relativePath = _configuration["OpenIddict:Endpoints:CheckSession"]!;
-
-            context.Metadata["check_session_iframe"] = baseUri.ToString().TrimEnd('/') + "/" + relativePath.TrimStart('/');
-
-            return default;
-        }
-    }
-
-    public class AttachSessionState : IOpenIddictServerHandler<ApplyAuthorizationResponseContext>
-    {
-        public ValueTask HandleAsync(ApplyAuthorizationResponseContext context)
-        {
-            if (context.Request?.ClientId is string clientId
-                && Uri.TryCreate(context.Request.RedirectUri, UriKind.Absolute, out var redirectUri)
-                && context.Transaction.GetHttpRequest()?.GetSessionId() is string sessionId)
-            {
-                var origin = redirectUri.GetLeftPart(UriPartial.Authority);
-                var salt = RandomNumberGenerator.GetHexString(8);
-
-                var utf8Bytes = Encoding.UTF8.GetBytes(clientId + origin + sessionId + salt);
-                var hashBytes = SHA256.HashData(utf8Bytes);
-                var hashBase64Url = Base64UrlTextEncoder.Encode(hashBytes);
-
-                context.Response.SetParameter("session_state", hashBase64Url + "." + salt);
-            }
-
-            return default;
-        }
-    }
 }

samples/Contruum/Contruum.Server/Startup.cs

@@ -1,5 +1,4 @@
 using System.IO;
-using System.Threading.Tasks;
 using Contruum.Server.Models;
 using Microsoft.AspNetCore.Authentication.Cookies;
 using Microsoft.AspNetCore.Builder;
@@ -38,16 +37,6 @@ public void ConfigureServices(IServiceCollection services)
                 options.AccessDeniedPath = "/connect/signin";
                 options.LoginPath = "/connect/signin";
                 options.LogoutPath = "/connect/signout";
-                options.Events.OnSignedIn = (context) =>
-                {
-                    context.Response.IssueSessionCookie();
-                    return Task.CompletedTask;
-                };
-                options.Events.OnSigningOut = (context) =>
-                {
-                    context.Response.DeleteSessionCookie();
-                    return Task.CompletedTask;
-                };
             });
 
         // OpenIddict offers native integration with Quartz.NET to perform scheduled tasks
@@ -112,12 +101,6 @@ public void ConfigureServices(IServiceCollection services)
                 // Register the event handler responsible for populating userinfo responses.
                 options.AddEventHandler<HandleUserinfoRequestContext>(options =>
                     options.UseSingletonHandler<Handlers.PopulateUserinfo>());
-
-                options.AddEventHandler<HandleConfigurationRequestContext>(options =>
-                    options.UseSingletonHandler<Handlers.AttachCheckSessionIframeEndpoint>());
-
-                options.AddEventHandler<ApplyAuthorizationResponseContext>(options =>
-                    options.UseSingletonHandler<Handlers.AttachSessionState>());
             })
 
             .AddValidation(options =>

samples/Contruum/Contruum.Server/appsettings.json

@@ -95,8 +95,7 @@
       "Introspection": "connect/introspect",
       "Token": "connect/token",
       "Userinfo": "connect/userinfo",
-      "Logout": "connect/endsession",
-      "CheckSession": "connect/checksession"
+      "Logout": "connect/endsession"
     },
 
     "Scopes": [