IdpSession Logout Problems

[Skylar Hansen]

I might try something like this:

http://kb.mozillazine.org/User:Dickvl/Private_Browsing_disable 

(Changing the about:config setting privacy.clearonshutdown.sessions)


-----Original Message-----
From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net]
On Behalf Of Brent Putman
Sent: Friday, October 28, 2011 2:19 PM
To: users at shibboleth.net
Subject: Re: IdpSession Logout Problems



On 10/28/11 11:41 AM, Cantor, Scott wrote:
>
>> According to Firefox documentation, this is not a
>> default setting, but our help desk manager is convinced that this is
the
>> default behavior.
> It is the default. Firefox used to save only non-secure cookies when
it
> did that, but they broke the feature by keeping all cookies in, I
believe,
> FF 4. Possibly earlier, but around then.
>

I was actually looking at this earlier this week to find out the current
state of things, since we've had some mild grumblings here about logout
and the lack thereof.  To add some detail to this:

>From what I learned, some of it from reading some Mozilla bugzilla
items
about it, this session persistence behavior is associated specifically
with the browser startup option "Show my windows and tabs from last
time".  Changing that to one of the other options should disable the
session persistence.  I did test this with FF 7.0.1.  This seems like a
viable option if you can lock down and control the machine, such as in a
lab or kiosk environment.

Scott, are you saying that the "show windows/tabs from last time" option
is the installation default now and/or on recent versions?  I didn't
find anything about that and I don't have a fresh machine on which to
test...

Further, and perhaps more importantly, if this option is enabled:  the
session cookies that it keeps around are tied to specific tabs.  So
closing the tab (or all tabs if multiple) that were associated with the
session will result in the session cookies for that tab(s) being thrown
away, and they are not there when the browser is shutdown and restarted.
I did also test that this basically works with FF 7.0.1 (although I
can't attest to all the possible modalities, etc).  It occurred to me
that if there is a way to have some (user agent-specific) client-side
Javascript via a button or link that caused all the tabs to be closed
before closing the browser, that might actually be a possible workaround
for this issue, e.g. have the app logout process return a page that says
"Click this button to close the browser and complete the logout
process".  I don't know enough client-side JavaScript to know whether
this is possible or not.  Does anyone?



--
To unsubscribe from this list send an email to
users-unsubscribe at shibboleth.net