Cookie destruction

[Mark O'Quinn]

Hi Peter, 

Thank you very much for your help! I'll be using just one SP so is good news :)


Hi Dhivakaran,

I was checking the code I sent you yesterday and there's something missing about the cookies, so here is how I delete the cookies:

	Cookie[] cookies = ((HttpServletRequest) servletRequest).getCookies();
            if(cookies != null) {
                for(Cookie singleCookie : cookies) {
                    singleCookie.setMaxAge(0);
                    ((HttpServletResponse)servletResponse).addCookie(singleCookie);
                }
            }

The previous code was inside the filter class that receives the logout process. So, for example if your logout page is named "logout_process.jsp", in the web.xml add the filter with the class that will contain the previous snipped code.


Cheers all


On Aug 10, 2012, at 3:39 AM, Peter Schober wrote:

> * Mark O'Quinn <mark1oquinn at gmail.com> [2012-08-10 02:49]:
>> Yes, I'm asking that, and specially related to the single logout. I
>> don't want to show to the user about closing the browser but to be
>> sure no session is kept with the service provider. is that correct?
> 
> There is no real problem with logout with a single SP (and a single
> IdP). Only when there could be many SPs with which the user might have
> sessions and which your IdP currently has no idea about,
> -peter
> --
> To unsubscribe from this list send an email to dev-unsubscribe at shibboleth.net