IntegrAuth Academy
Identity, security and practical AI — free, from zero. Byte-sized lessons, real diagrams, hands-on labs, zero fluff. Two programs, each with its own exam and certificate.
English is hard? Your browser can translate this page into Tamil, Telugu, Kannada, Malayalam or Hindi. Tech words stay in English so you learn the real names.
How?
- Chrome on phone: ⋮ menu → Translate
- Chrome on computer: right-click → Translate to …
- Edge: the translate icon in the address bar
Sessions, cookies & sign-out
Maya's login is one moment. Her session is the hour that follows. A sign-out is real only if every session that login made also ends. Your goal: keep a session safe and end it fully.
- One login makes three things: IdP session, app sessions, tokens.
- Cookie flags protect the session: HttpOnly, Secure, SameSite.
- Clearing one app cookie is not a real logout.
- Back-channel logout is the reliable way to end sessions.
Three sessions, three clocks
Priya signs in through enterprise SSO. She does not make one session. She makes three things, each on its own clock.
| What | Where it lives | Its job |
|---|---|---|
| IdP session | A cookie at the identity provider | The SSO master. It signs you in quietly at the next app. It often lives longest. |
| App session | A cookie at each app | Each app keeps its own local session. One per app. |
| Tokens | Held by the app or the API layer | Access and refresh tokens for APIs. Each has its own expiry. They live shortest. See where tokens are born. |
The session cookie and its flags
A session is only as safe as the cookie that carries it. Three flags and a good expiry make it hard to steal.
🔒 HttpOnly
With HttpOnly, JavaScript cannot read the cookie. This blunts a cross-site scripting attack. Without it, the attack could send the cookie to an attacker.
🔐 Secure
The cookie is sent only over HTTPS, never plain HTTP.
🧭 SameSite
With Lax or Strict, the browser does not attach the cookie to requests from other sites. This is the main defense against CSRF.
⏳ Short, sliding expiry
An idle timeout resets when the user is active. A hard maximum sits above it. A forgotten open tab should not stay signed in for a week. Net banking does this: leave the page idle for a few minutes and it signs you out.
Sign-out done right
Clearing the local cookie is not logout. Delete App A's cookie, and the IdP session is still alive. When Priya visits App A again, SSO signs her right back in. Tokens that have not expired keep working too. Real sign-out must reach further.
🚪 RP-initiated logout
The app sends Priya to the IdP's end_session address. The IdP session ends too.
🖼️ Front-channel logout
The IdP loads a hidden frame for each app to clear its cookie. It is simple but fragile. A silent failure leaves a session alive.
📡 Back-channel logout
The IdP sends a signed logout_token from its server to each app's server. No browser is needed. It works even after Priya closes the tab. This is the reliable one.
Priya checks her mail at a cyber café. She only closes the browser tab. The next person opens the same site and is already inside her mail. Closing a tab does not end a session. Signing out does.
Single logout: Priya leaves the company
Priya resigns. The IdP session, every app session and the refresh tokens behind them must all end. This is single logout. Back-channel logout reaches every app in the SSO estate.
Some systems sit outside the logout loop. For those, a CAEP "session revoked" event goes out over Shared Signals. It says "this person is gone". Receivers drop her in seconds. This closes the joiner, mover, leaver lifecycle.
A login you cannot fully reverse is a risk that outlives the employee. End the IdP session. Prefer back-channel over front-channel. Kill the tokens, not only the cookie. Native apps add a twist: see native-to-web SSO.
Go deeper: session fixation
Session fixation is an attack. The attacker plants a session ID they already know before Priya logs in. If the app keeps that same ID after she signs in, the attacker shares her signed-in session.
The fix is simple. Always create a brand-new session ID when a login succeeds. Never accept a session ID from outside.
Front-channel logout is also weak because browsers increasingly block third-party cookies. See Signing out across apps for the protocol details, and CAEP & Shared Signals for the version that spans many systems.
🧪 Interactive lab — enable JavaScript to play with this one.
Grade your issuer's logout and revocation setup with Logout Check. Score the cookie flags (HttpOnly, Secure, SameSite) with Cookie Check.