Questions about sessions about fosite

[aeneasr]

The session is three things:

1. A way to persist data across /auth and /token endpoints. For example: The token endpoint probably wants to know who gave consent - that data is however only available at the /auth endpoint. Therefore we need to persist some sort of state across requests.
2. Some fosite extensions (for example ID Tokens or JWT Access Tokens) also need to know some data (e.g. which user, what time, which scope, ...). The session is being passed down to those extensions and is therefore used for transporting information.
3. Anything you want to be available at the /token endpoint. Let's say the users phone number to notify him when someone requested an access token!

What the session looks like is depending on what functionality you use (JWT for example demands a specific session type) and what data you want to have. If you ever worked with osin, the session is basically the UserData object.

Also check out the example. It explain things even more.

[saintfiends]

So Storage implementation is supposed to serialize and store session information along with request information.

[aeneasr]

Yup

[saintfiends]

Thanks for the prompt response. I think that description is a perfect fit for the documentation.