Cookie destruction

[Cantor, Scott]

On 11/28/12 5:12 PM, "Mark O'Quinn" <mark1oquinn at gmail.com> wrote:
>
>Deleting the cookies that comes along with the request object from the SP
>to the logout servlet of the idp (I create the logout servlet in the idp)

If you mean "any cookies it sees", then perhaps the IdP's session cookie
isn't actually seen by it. Or something else is wrong with that code.

>I've looked for the method destroySession that accepts a session object
>as its parameter but the only one I see in the class SessionManagerImpl,
>accepts String parameters only. Am I calling the wrong method?

No, I was mistaken.

>At the end I've decided to delete the session (I think it's better)
>instead of the cookies, because with the cookies you've to reference
>correctly the domain and the path (which I was doing) with the cookies,
>but at the end the cookies remained. I must have reference inexistent
>cookies.

I suspect you didn't have the right domain/path. And I agree that isn't
what you want to base it on.

-- Scott