Web Agent Guides › Web Agent Configuration Guide › Single Sign-On (SSO) › How to Configure Single Sign-On › Enable Single Use Session Cookies

Enable Single Use Session Cookies

You can increase the security of your environment by having SiteMinder create session cookies that are only used once. Single-use session cookies prevent anyone with access to the following items from copying a session cookie and then re-using it to gain unauthorized access to resources:

• Web server logs
• SiteMinder Web Agent logs
• Potentially compromised proxy servers sitting between domains (in the case of cross domain single sign on)

You can control whether SiteMinder uses single-use or multiple-use session cookies by setting the following parameter:

• StoreSessioninServer

  Specifies whether single-use session cookies are used. When the value of the StoreSessioninServer parameter is yes, a single-use session cookie is created and stored on the session server. Cookie providers and Web Agents access the cookie from the session server.

  Cookie providers and Web Agents replace the session cookie in a URL with a GUID that corresponds to the single-use session cookie stored on the session server.

  When the value of the StoreSessioninServer parameter is no, the session cookie is passed directly in the URL

  Default: No

To enable single use session cookies

1. Ensure your environment meets the following conditions:
   • Upgrade your Web Agents and cookie providers to use SiteMinder 6.0 SP5 QMR1 or higher.
   • Use a value for the DefaultAgentName parameter in the Web Agents and cookie provider.
   • Your Policy Server is configured with a valid session store.
2. In your Web Agents and cookie provider, set the value of the StoreSessioninServer parameter to yes.