Identity/Verified Email Protocol/Session API: Difference between revisions

Identity/Verified Email Protocol/Session API (view source)

Revision as of 23:49, 27 July 2011

1,044 bytes added , 27 July 2011

Starting on Multiple Sessions.

Stomlinson

Confirmed users

134

edits

@@ Line 72: / Line 72: @@
      navigator.id.sessions = [{
          id: 'yogibear@jellystone.nps.gov',
-        status: 'active',
          bound_to: {
              type: 'cookie',
@@ Line 87: / Line 86: @@
 If neither are available, the browser will assume both that the session information has expired and the page does not support the session API - it will remove the session status indicator.
+===Multiple Sessions===
+Multiple sessions can be declared in navigator.id.sessions, there can be 0 or 1 active sessions.  An example of where this could be used is with Google's multiple session support.  If more than one session is declared "active" only the first will be used.
+====Example - Multiple sessions, none active====
+    // Our bear is masquerading as two bears.
+    navigator.id.sessions = [{
+        id: 'poohbear@ashdownforest.gov.uk'
+    }, {
+        id: 'yogibear@jellystone.nps.gov',
+    }];
+====Example - Multiple Sessions, one active====
+    // Our bear is masquerading as two bears.
+    navigator.id.sessions = [{
+        id: 'poohbear@ashdownforest.gov.uk',
+        status: 'active'
+    }, {
+        id: 'yogibear@jellystone.nps.gov',
+    }];
+If 0 sessions are currently active, the browser status button will read "login".  When the user clicks the button, they will be presented a the doorhanger to select a session.  When the user selects a session, the "login" event will be triggered with the selected id given as the "id" field of the event object.
 ===Changing Sessions===
-*** This needs hammered out, how is this going to work?
+;This needs hammered out, how is this going to work?
 We could trigger a logout, then a login, but unless the site knows that the user is trying to change sessions, it may redirect the user to the logout page, breaking the flow.
-Could we trigger the login directly but pass the id the user is trying to log in with?  This would also cover multiple inactive sessions.  Once the site receives the login event when a session is already active, it could take appropriate action.
+A better alternative is to directly trigger the login with the new id in the event object.  If a session is already established with the site, it should invalidate the old session and begin the procedure for logging in with the new id.
 ===Updating/Clearing Session Information===