Web Agent Guides › Web Agent Configuration Guide › Single Sign-On (SSO) › How to Configure Single Sign-On › Protect Session Cookies from Misuse with Validation Periods and Expired Cookie URLs

Protect Session Cookies from Misuse with Validation Periods and Expired Cookie URLs

SiteMinder uses time-based session cookie parameters that can substantially reduce the possibility of a SiteMinder session cookie being compromised by administrators or other users who have access to the following items:

• Web server logs
• SiteMinder Web Agent logs
• Potentially compromised proxy servers sitting between domains in the case of cross-domain single sign-on

These time-based session cookie parameters add the concept of "born dates" to session cookies. Agents receiving a session cookie as a result of a redirect (URL session cookie) will look for the cookie born date name/value pair and compare this value with the value set for the CookieValidationPeriod configuration parameter. If the value of the born date and the CookieValidationPeriod parameter value exceed the current time, the cookie is rejected.

To protect session cookies from misuse, set the following parameters:

• CookieValidationPeriod

  Specifies the time period (in seconds) in which the receiving agent will accept the session cookie. After this time passes, the session cookie will not be accepted. If this field is not used or is set to zero, the session cookie expires when the Idle Timeout and Max Session Timeout values are met.

  Default: Empty.

• ExpiredCookieURL

  (Optional) Specifies a URL that the agent redirects the user to after any session cookie has expired. If neither the born date nor the CookieValidationPeriod are configured, the agent ignores the settings and processes the cookie as usual (backwards compatibility).