Property RevalidateHubConnections

Gets or sets a value indicating whether the sessions of SignalR hub connections are revalidated, in an app that registers SignalR. Default is true.

Declaration
public bool RevalidateHubConnections { get; set; }
Property Value
Type Description
bool

When a connection connects with a session cookie that is due for a refresh, its session is validated against the session store before the hub's OnConnectedAsync() runs, as retrieving the session token would, without its origin and user ID precondition checks. A session that has ended leaves the connection without a session, and an UnauthorizedApiException from the store fails the connection. Exceptions from this validation are reported as ApiExceptionHubFilter reports exceptions, whether that filter is added or not.

The session token of each connection that has a session when it connects is kept. Connections without a session are not tracked. About once a minute, the sessions of the connections that were last checked at least RefreshAfter ago are looked up in the session store. A connection whose session has ended, expired or reached its maximum lifetime is closed, with the other connections with its token: each is sent a message with the error that ended the session, an UnauthorizedApiException with the SignInRequired error code or the one that the store threw, which the toolkit's client handles by closing the connection, and is aborted if it is still open 5 seconds later. Its hub method calls fail with the error meanwhile. A session that ends in any way, such as with a sign-out, a sign-in that replaces it, or the app removing it from the store, closes its connections at their next check on each server that has them, within about RefreshAfter and a minute of its end.

An open connection counts as use of its session: a live session's expiry time is moved to a full expiry period after the check, capped at the end of its maximum lifetime, through TryRefreshSessionAsync(TSessionToken, SessionRecord, int, CancellationToken). Its refresh time and generation do not change, since the connection cannot deliver a new session cookie to the client, and the client's session cookie stays valid for its requests. If a request refreshes the session in the meantime, the session is looked up again.