SP V3 client side session questions

Cantor, Scott cantor.2 at osu.edu
Wed Feb 21 12:27:16 EST 2018

If you have development questions, please move that to the dev list or just add comments to the JIRA issue.

The mechanism is based on a shared AES key and AES-GCM encrypted data with a rolling key, same as the IdP uses. The ability to invalidate everything and everybody at once isn't actually disappearing because restarting the in-memory caches and just replacing the active key(s) will render any blobs in the wild unusable.

-- Scott

More information about the users mailing list