Interface: OcSessionOptions
Defined in: me-client/src/server.ts:221 (opens in a new tab)
ExtendsLink to this section
Extended byLink to this section
PropertiesLink to this section
| Property | Type | Description | Defined in |
|---|---|---|---|
audience? | AudienceRule | Accepted aud · see AudienceRule. An integrator verifying tokens from the sign-in popup sets this to its own origin, e.g. "https://example.com", so a token issued to another site is refused.Inherited from VerifyOcTokenOptions.audience | auth-core/src/index.ts:828 (opens in a new tab) |
issuer? | string | Auth host issuer. Defaults to https://ochk.io (opens in a new tab).Inherited from VerifyOcTokenOptions.issuer | auth-core/src/index.ts:818 (opens in a new tab) |
jwksCacheTtlMs? | number | JWKS cache TTL in ms. Defaults to 1 hour. Stale-on-error: if the cache exists, verification still works during a transient outage.Inherited from VerifyOcTokenOptions.jwksCacheTtlMs | auth-core/src/index.ts:821 (opens in a new tab) |
jwksMaxStaleMs? | number | How old a cached JWKS may be and still stand in during an outage. Defaults to 6 hours; past it, verification fails closed.Inherited from VerifyOcTokenOptions.jwksMaxStaleMs | auth-core/src/index.ts:824 (opens in a new tab) |
meOrigin? | string | Where me.ochk.io is: the project's sign-in rule and its list of ended sessions are read there. Default https://me.ochk.io (opens in a new tab) (OC_ME_ORIGIN for the list).Inherited from - | me-client/src/server.ts:235 (opens in a new tab) |
method? | string | The request's method. While me.ochk.io's list of ended sessions can't be read, reads go on and writes are refused; with no method, a request counts as a write. The adapters pass it for you.Inherited from - | me-client/src/server.ts:227 (opens in a new tab) |
projectKey? | string | Your project key. Default OC_PROJECT_KEY.Inherited from - | me-client/src/server.ts:229 (opens in a new tab) |
requireHandle? | boolean | Refuse a token bound to your site (one with aud) that carries no rh, its handle on your project's list of ended sessions. Without it "sign out everywhere" can't reach the session, so it is refused by default. Every token ochk.app's sign-in popup issues carries one; false accepts one minted some other way, and then sign out everywhere does not end it. A family session (no aud, on *.ochk.io) is not held to this: the family's own feed ends it. audience: '*' admits family sessions too, so keep it for routes that receive tokens forwarded from *.ochk.io. Default: true.Inherited from VerifyOcTokenOptions.requireHandle | me-client/src/server.ts:91 (opens in a new tab) |
revocation? | false | RevocationCheck | The check for sessions the person ended everywhere (sign out everywhere, a passkey removed, the account deleted). Default: auth-core's integratorRevocationCheck, from OC_PROJECT_KEY and OC_SIGNING_SECRET; none when they are unset. false turns it off.Inherited from - | me-client/src/server.ts:242 (opens in a new tab) |