02 / Authentication

Authentication and sessions

Authentication uses OpenID Connect (OIDC). Read protocol endpoints from the discovery document. Do not hard-code the login page URL or reuse a temporary URL generated by a previous login attempt.

Open the OIDC discovery document

Web BFF

The application backend maintains the browser session.

OAuth tokens stay on the server. The browser uses only a protected session cookie. Configure login, session restoration, and logout according to the backend's session integration contract.

Web SPA / native application

Use Authorization Code + PKCE (S256).

Use an administrator-registered public client and an exact callback URL. Do not configure client secrets in browsers or native applications. Test how tokens and business sessions work together.

1# Read authorization, token, key, and other endpoints from the discovery document.2curl --fail --silent --show-error \3  'https://sso.iyoucloud.com/realms/iyoucloud/.well-known/openid-configuration'

Design sessions and logout together

After handling the callback, verify business session creation, restoration after a page refresh, and expiration handling. Use the session API implemented by your application for logout. Apply its policy to distinguish the current session, a selected device session, and other supported scopes. Clearing local storage does not replace server-side logout.

The authorization callback must validate state, nonce, and PKCE. Business APIs must also check identity, tenant context, and resource permissions. A successful login does not grant all business permissions.