Session removal and old session cookie concepts
When a user uses the /pkmslogout command to log out of a session, the entry for that user in the WebSEAL session cache is automatically removed.
If the session cookie for that session remains on the browser of the user, it becomes an old, or stale cookie. A stale cookie no longer maps to an existing entry in the WebSEAL session cache. When the user makes a subsequent request for a protected object, WebSEAL requires authentication and returns a login form. The response to the new request under these conditions must be expected by the user. If the user session was removed from the WebSEAL session cache for unknown reasons, the original session cookie remaining on the browser of the user becomes a stale cookie. The stale cookie does not map to an existing entry in the WebSEAL session cache. Session timeout, session displacement, or session termination are some of the reasons which might cause the session removal from WebSEAL, and might be unknown to the user.
When the user requests for a protected object, WebSEAL requires authentication, and returns a login form. This response to the new request under these conditions might be unexpected to the user.
We can customize the login response to contain additional information that helps to explain the reason for an unexpected login prompt. Follow these steps to provide a customized response:
- Trigger a custom login response whenever WebSEAL receives a stale session cookie that does not map to any existing entry in the session cache.
- Configure WebSEAL to attempt to remove the session cookie from browsers during standard logouts using the /pkmslogout command.
- Triggering a custom login response
The standard WebSEAL login forms contain a macro called OLDSESSION. The OLDSESSION macro can be blank by default, or have a value of 1. When WebSEAL receives a stale session cookie that does not map to any existing entry in the session cache, the OLDSESSION macro value is set to 1.- Remove cookies from browsers during normal logout
By default, WebSEAL does not remove cookies from client systems during session termination, regardless of the cause of the termination. The termination might either be initiated by a client logout or by the server. This means the value of the OLDSESSION macro is always set to 1 when a user makes a subsequent request after the session termination. The scenario makes it impossible to trigger a custom login response.
Parent topic: Customized responses for old session cookies