[woksin]

Summary

Services can now opt in to receiving when the browser session started and which provider the user signed in with, as part of the forwarded identity.

Added

• Opt-in ForwardSessionContext service setting that adds the browser session start time (urn:cratis:session:started) and sign-in provider (urn:cratis:session:sign-in-provider) claims to the forwarded principal (Optionally forward the browser session start time and sign-in provider to backends #327)

Security

• Session context claims arriving from bearer tokens, invite metadata or upstream identity providers are discarded, so callers cannot spoof session start or sign-in provider (Optionally forward the browser session start time and sign-in provider to backends #327)

[woksin]

Folded items

• l113-327-session-forwarding at 6f7157d9e21b99c85c755cbee7efdbd055b50834; cancelled runs: none

Verification

build: authproxy train-e Release build (2026-11-12T18:43:53.492777Z)
test: authproxy train-e AuthProxy.Specs (2026-11-12T18:45:32.321844Z)
test: authproxy train-e Security+Aspire specs (2026-11-12T18:46:36.340649Z)
test: authproxy train-e Aspire.Specs (2026-11-12T18:46:44.776126Z)

[woksin]

Reviewer notes

• Gate on the train head: Release build with warnings as errors, AuthProxy.Specs (6394), Security.Specs and Aspire.Specs (net10 and net11) all passed.
• Cross-provider deep security review passed with no blocking findings. Advisory: during an on-behalf session the forwarded session start and sign-in provider describe the actor's browser session while the principal is the represented user; worth a follow-up decision if consumers need to distinguish this.
• The feature is off by default (ForwardSessionContext: false); the forwarded identity signing format is unchanged.