Terminating the IdP Session in an Login Extension

[Chad La Joie]

On Wed, Jun 27, 2012 at 12:42 PM, Joshua Brodie <josbrodie at gmail.com> wrote:
> I guess I am puzzle why the session persists when user is redirected
> off-site - i.e. the user has a session when hitting the back-button.

An IdP session is not created until after the login handler completes
and redirects back to the authentication engine.  The session cookie
is called _idp_session.  Use something like Chrome's web dev tools or
Firefox with Live HTTP Headers and look.  You shouldn't see the
_idp_session cookie set until after the redirect to the authn engine.

-- 
Chad La Joie
www.itumi.biz
trusted identities, delivered