Lightning Out --- How to go around session persistence

Question

We currently have an LWC component. It is targeted to be used in 3rd party sites. The best way to do this is via Lightning Out.

We therefore created a lightning out application, it is currently embedded in a nodeJS app.

We provide access token to it via the JWT-bearer flow. This flow uses a different user solely intended for lightning out authentication use. There's no problem on this part. Below is the success json we receive:

"data":{
  "access_token":"<token>",
  "scope":"web",
  "instance_url":"https://<our-domain>.cs123.my.salesforce.com",
  "id":"https://test.salesforce.com/id/<id>/<id>",
  "token_type":"Bearer"
}

The access_token above is what we provide the lightning out app.

Now here comes the problem. In an active browser tab, we load the nodejs app web page, then the lightning out app loads without a problem. However, once we log in to salesforce in another tab, it will successfully get authenticated, but the persisted session (created by the lightning out loading in the first tab) is used instead of the session that I expect to see when I logged in using my credentials.

I am aware of Salesforce's instructions here: https://developer.salesforce.com/docs/component-library/documentation/en/lwc/lwc.lightning_out_authentication. I'm also aware of the instructions about how to prevent session persistence. However, I don't seem to understand how this works. As you can see, we go through JWT flow once the web server starts, and then we pass the resulting access token to the page only once it loads. But even if we lock the session to the originating IP, the problem still persists. How exactly should we implement this "lock the session to the originating IP address"?

Answer 1

As per my understanding, Once the authentication is completed, the session maintained at the browser level. Since you are already using the same machine to access Salesforce and nodejs app the session pickup from cookies and validated the IP address when you are using "lock the session to the originating IP address".

If the session id generates with in the same IP address then you can able to login into Salesforce in a different tab.

I don't see any valid workaround for this scenario to generate a new session id.