<html>
<head>
<meta content="text/html; charset=windows-1252"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<p>Don't do that. The browser cookie needs to be between the RP and
the browser, not the IdP and the browser. The demo application
follows the correct pattern: use the ID token to establish
authentication, then create a session in the application itself.</p>
<p><br>
</p>
<p> -- Justin<br>
</p>
<br>
<div class="moz-cite-prefix">On 8/25/2016 10:06 AM, Michael Furman
wrote:<br>
</div>
<blockquote
cite="mid:AM5PR0701MB25306FBE3E6C6CCF51B88B54F4ED0@AM5PR0701MB2530.eurprd07.prod.outlook.com"
type="cite">
<meta http-equiv="Content-Type" content="text/html;
charset=windows-1252">
<style type="text/css" style="display:none;"><!-- P {margin-top:0;margin-bottom:0;} --></style>
<div id="divtagdefaultwrapper"
style="font-size:12pt;color:#000000;background-color:#FFFFFF;font-family:Calibri,Arial,Helvetica,sans-serif;">
<div>
<p class="MsoNormal">Hi all,</p>
<p class="MsoNormal">I want to put into a browser cookie the
ID token after the OpenID Connect implicit flow.</p>
<p class="MsoNormal">I want to eliminate the redirects to IDP
for each requests.</p>
<p class="MsoNormal">How to do it?<br>
Do we have any RFC that describes how to make RP stateful?</p>
<p class="MsoNormal"> </p>
<p class="MsoNormal">I do know that the demo simple-web-app
adds Jsession cookie after the authentication.</p>
<p class="MsoNormal">My question if we have some RFC and
therefore all RP may be stateful.<br>
Thank you in advance for your help.</p>
<p class="MsoNormal"> </p>
<p class="MsoNormal">Best regards,</p>
<p class="MsoNormal"><span style="mso-spacerun:yes"> </span>Michael</p>
</div>
<br>
</div>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
<pre wrap="">_______________________________________________
mitreid-connect mailing list
<a class="moz-txt-link-abbreviated" href="mailto:mitreid-connect@mit.edu">mitreid-connect@mit.edu</a>
<a class="moz-txt-link-freetext" href="http://mailman.mit.edu/mailman/listinfo/mitreid-connect">http://mailman.mit.edu/mailman/listinfo/mitreid-connect</a>
</pre>
</blockquote>
<br>
</body>
</html>