How Cookie Revocation Works

Version Affected: All

 

Overview

Cookie Revocation is a setting that revokes a user's authentication cookie once the browser closes or the session expires, so the cookie cannot be reused afterward. In Cloud deployments this is enabled by default. In Hybrid deployments it is disabled by default, and enabling it requires mapping an attribute to the Cookie Revocation Keys profile property in the datastore -- that attribute must be a single-valued string property (Directory String), since its value is stored as a delimited list.
 

How Cookie Revocation Works

Each authentication cookie is assigned a Globally Unique Identifier (GUID), which is saved to the user's profile. When the user reaches the Post Authentication page, the cookie's GUID is validated against the value saved in the profile -- if the two do not match, the user is logged out.
 

Cookie Revocation Attribute Value Format

The mapped attribute stores the name of the Post Auth token followed by its GUID:

PostAuthToken5:[GUID]

The number of entries depends on how many distinct Post Auth cookie names the user's realms use. If every realm shares the same Post Auth cookie name, the attribute holds a single GUID. If different realms use different Post Auth cookie names, the attribute holds multiple GUID entries, one per cookie name.
 
 

SecureAuth Knowledge Base Articles provide information based on specific use cases and may not apply to all appliances or configurations. Be advised that these instructions could cause harm to the environment if not followed correctly or if they do not apply to the current use case.

Customers are responsible for their own due diligence prior to utilizing this information and agree that SecureAuth is not liable for any issues caused by misconfiguration directly or indirectly related to SecureAuth products.