Troubleshooting: Password in a Custom Cookie Token Breaks Logins and TSSO

Version Affected: 22.12 onwards
 
 

Overview

Some Service Provider setups require the user's password to be added to the authentication cookie. If the password contains a comma and is added without encoding it, subsequent logins and Transparent SSO (TSSO) can break.

Cause

Cookies in modern versions of SecureAuth contain several comma-separated values, used to prevent unauthorized re-use. If a value added to the cookie -- such as a password -- itself contains a comma, it shifts the placement of every value after it and invalidates the cookie.

Resolution:

A fix exists in 23.07 HF2 onwards that lets you change the delimiter so it no longer conflicts with special characters in passwords. To resolve this:

1. Decrypt the Web.config.
2. Search for Delimiter.
3. Add the delimiter of your choice, for example:

<add key="Delimiter" value=":" />

4. Save the web.config and test.

Special Considerations

If a password must be included in the cookie, use the B64 option to encode it -- this avoids the comma problem in the first place. Regardless, SecureAuth does not recommend including passwords in cookies at all.


 

SecureAuth Knowledge Base Articles provide information based on specific use cases and may not apply to all appliances or configurations. Be advised that these instructions could cause harm to the environment if not followed correctly or if they do not apply to the current use case.

Customers are responsible for their own due diligence prior to utilizing this information and agree that SecureAuth is not liable for any issues caused by misconfiguration directly or indirectly related to SecureAuth products.