Reverse Proxy Cookie Tracking for Secure Single Sign-Off
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing web portal systems face challenges in managing HTTP cookies across multiple backend applications, leading to issues with session management and single sign-off, as cookies can persist in the browser cache, potentially allowing previous users' sessions to be reused by new users, and existing solutions require manual scripting or intrusive modifications.
Innovation Solution
A reverse proxy manages cookies by tracking and expiring them using a per-user session cache object, sending 'Set-Cookie' headers with past expiry dates to delete cookies from the browser cache during logout, ensuring secure single sign-off without blocking cookie flow to the browser.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If cookies are allowed to flow back to the web browser during user session, then operational correctness and application functionality are maintained, but session security is compromised as previous users' sessions can be reused by new users
Solution Approach 1:
The reverse proxy acts as an intermediary between the web browser and backend applications, intercepting cookies in transit. It stores cookies temporarily and selectively forwards them to the browser only when needed, while maintaining the ability to revoke access. This mediator role allows the system to maintain both security (through centralized control) and operational correctness (through selective cookie forwarding).
Solution Approach 2:
The system performs preliminary actions by pre-storing cookies in the reverse proxy before they reach the browser. By having cookies available in advance at the proxy, the system can quickly revoke them by simply stopping forwarding, without needing to actively delete them from the browser. This preliminary storage enables rapid session termination while maintaining normal cookie flow during authenticated sessions.
2Reliability
If manual scripts are embedded in logoff page to clear cookies, then session security is improved, but device complexity and administrative burden increase
Solution Approach 1:
The reverse proxy automatically manages cookie lifecycle without requiring manual intervention. It autonomously intercepts cookies, stores them, forwards them to browsers, and revokes them upon logout by simply stopping the forwarding process. This self-service approach eliminates the need for administrators to manually create and maintain complex scripts for each application, reducing operational complexity while maintaining security.
3Reliability
If cookies are stored in proxy cookie jar without sending to client browser, then session security is improved, but application functionality deteriorates as cookies are needed for web application to operate correctly
Solution Approach 1:
The system dynamically adjusts cookie forwarding based on authentication state. During authenticated sessions, the reverse proxy actively forwards cookies to the browser to ensure application functionality. Upon logout, it dynamically stops forwarding and revokes cookies to ensure security. This dynamic behavior allows the system to optimize for functionality during work and security during logout, resolving the contradiction between these two requirements.
Data Source
AI summary
An intermediary (such as a web reverse proxy), which is located between a web browser and one or more backend applications, manages cookies that are provided by the backend applications and returned to the web browser during a user session. When a session sign-off event is initiated in the reverse proxy, HTTP “Set-Cookie” headers are sent back to the web browser to destroy the cookies (in the browser) that represent sessions with the one or more backend application(s).