Size of client-side sessions

[Cantor, Scott]

>>I suppose that there is a question though:  Do you believe there is
>>anything we can do in the IdP Design to handle these sorts of buggy
>>browsers?  It
>>strikes me that your idea of being able to say "And here are all the
>>Sessions you have not been logged out of" might be useful - even if just
>>for didactic purposes.

I should add that there is one thing in the IdP design that is important
in this context, and that's getting to a state where access to the session
cookie isn't a requirement for logout.

I can't make applications handle logout properly without the cookie, but
the fact is that they won't get it in any sane UI for logout.

So it's very critical to make sure the IdP and SP don't need access to the
session cookie. Being able to get to the right session(s) via entityID and
NameID makes that possible. And the SP was fixed in 2.5 to handle front
channel LogoutRequests without the session cookie present.

-- Scott