ISO/IEC 26135:2024 - Overview
ISO/IEC 26135:2024, "Information technology - OpenID Connect - OpenID Connect session management 1.0", standardizes how OpenID Connect (an identity layer on top of OAuth 2.0) manages user sessions and coordinates logout behavior between OpenID Providers (OPs) and Relying Parties (RPs). It defines lightweight, front‑channel mechanisms to detect changes in an End‑User’s login state (so RPs can update or terminate local sessions) without frequent network polling.
Key topics and technical requirements
- Session State (session_state): an opaque JSON string returned in the authentication response. It MUST NOT contain spaces and is used to represent the End‑User’s login state at the OP.
- Session creation/updating: RPs start sessions upon validating an ID Token (see OpenID Connect Core 1.0). OPs MUST return session_state when supporting session management.
- RP iframe / OP iframe architecture:
- The RP loads an invisible RP iframe that periodically sends a postMessage containing "ClientID + ' ' + session_state" to the OP iframe.
- The OP exposes a check_session_iframe that recalculates the session state from Client ID, source origin, OP user agent state and a salt, then replies with "unchanged", "changed", or "error".
- State verification and re‑authentication:
- On "changed", RPs SHOULD perform an iframe prompt=none request (sending id_token_hint) to obtain an updated ID Token/session_state and treat mismatches as logout.
- On "error", RPs MUST NOT attempt prompt=none to avoid loops.
- Security controls:
- Strict origin validation on postMessage exchanges; reject unexpected origins to prevent XSS/CSS attacks.
- OPs should avoid placing identifying user data in JavaScript‑accessible cookies (HttpOnly may not be usable).
- Implementation notes: guidance on salt randomness, OP user agent state management, and IANA registries for OAuth parameters and metadata.
Applications and who should use it
- Identity providers, authorization server implementers, and OpenID Provider developers who need standardized session tracking and logout propagation.
- Web and mobile application developers (Relying Parties) integrating OpenID Connect for single sign‑on (SSO) and coordinated logout.
- Security architects and SSO integrators seeking interoperable, low‑traffic session notifications across domains.
Related standards
- OpenID Connect Core 1.0 (authentication, ID Tokens)
- OpenID Connect Front‑Channel Logout 1.0
- OpenID Connect Back‑Channel Logout 1.0
- OpenID Connect RP‑Initiated Logout 1.0
- OAuth 2.0 (RFC 6749)
This standard helps implement robust, interoperable session management for OpenID Connect deployments, minimizing client polling while ensuring secure logout and session integrity.