Cloned from launchpad blueprint https://blueprints.launchpad.net/keystone/+spec/tokens-in-secure-cookie.

Description:

In order to implement HATEOAS, Keystone clients will need to be able to authenticate, and to have the authentication stick across multiple requests.  Passing it in a custom Header does not work with web browsers.

If the HTML request specifies an accepted content type of  HTML or XHTML,  the token HASH should be stored in a secure Cookie.  Additional requests to Keystone will then check for the presence and validity of the HASH in order  to continue to authenticate  the user requests.

Only unscoped token issued will be stored in the Secure cookies.
Requesting an additional unscoped token will replace the unscope token in the the cookie, but will not extend the lifetime unless it is accompanied by valid credentials used to issue a token in the first place.




Specification URL (additional information):

None