LTPA Token Not Changing

2.1k Views Asked by At

When I log out of an application on WebSphere and back on, the LTPA token is unchanged. I thought it would change because session tokens are supposed to be unpredictable.

2

There are 2 best solutions below

0
On

Session cookies (JSESSIONID) do not change on several product versions when logging out. This is because unauthenticated users may also have sessions. There is no actual problem there. The SSO cookies (LTPAKEY and LTPAKEY2) will get invalidated on any proper logout.

It is also possible that your application is faulty. In that case what you have is a custom authentication system built into your system not taking into account the WebSphere Application Server provided mechanisms properly. The applications should probably call for real invalidation, for example.

1
On

What do you when you log out of your application?

Are you invalidating the LTPA cookie?

If not, the browser has the LTPA cookie which tell the APp Server that you are authenticated as far as it is concerned.

Do not assume that session ID and HTTP Sessions and LTPA are one and the same.