In IdentityServer4 what is the difference between the 'idsrv' and the 'idsrv.session' cookie?

Question

I understand that the idsrv.session cookie is used to detect whether or not a user's session has changed. This cookie is part of the the OIDC Session Management implementation that is provided in IdentityServer. What I then don't understand is what the idsrv cookie is used for. Can someone please explain?

Answer 1

The .session cookie is only used by the session monitoring endpoint to detect if the current session has changed. You’ll notice that it is not set as HTTP only and thus can be accessed by script run by that endpoint. It is not the authentication cookie.