diff --git a/src/content/docs/identityserver/aspnet-identity/schemes.md b/src/content/docs/identityserver/aspnet-identity/schemes.md index a9c0fdbb..6911db30 100644 --- a/src/content/docs/identityserver/aspnet-identity/schemes.md +++ b/src/content/docs/identityserver/aspnet-identity/schemes.md @@ -62,7 +62,7 @@ IdentityServer always uses the `"idsrv.external"` scheme here, available in the IdentityServer session management requires a separate cookie to monitor the session state without sending the large authentication cookie. The [User Session Service](/identityserver/reference/services/user-session-service.md) manages this cookie. -- **Default Name:** `"idsrv.session"` (Constant: `IdentityServerConstants.DefaultCheckSessionCookieName`). This often remains consistent, but verify your specific configuration. +- **Default Name:** `"idsrv.session"` (Constant: `IdentityServerConstants.DefaultCheckSessionCookieName`). Note this cookie is not marked as `HttpOnly`, so it can be accessed in client-side code. The JavaScript code that is required to check user sessions in the background also requires access to this cookie, and needs it to be `HttpOnly`. diff --git a/src/content/docs/identityserver/ui/logout/external-notification.md b/src/content/docs/identityserver/ui/logout/external-notification.md index 76b6efb5..5e494ef8 100644 --- a/src/content/docs/identityserver/ui/logout/external-notification.md +++ b/src/content/docs/identityserver/ui/logout/external-notification.md @@ -20,7 +20,7 @@ clients that the user has signed out. This notification usually comes in the form of a request in an `