Enabling Okta global session cookies to persist across browser sessions allows users to remain authenticated after closing the browser. The expected behavior differs depending on whether the feature is enabled or disabled, the administrative privileges of the user, and the Okta engine in use.
- Okta Identity Engine (OIE)
- Global Session Policy
- Okta Global Session Cookies Persist Across Browser Sessions
What is the behavior when the Okta global session cookies persist across browser sessions setting is disabled?
When the Okta global session cookies persist across browser sessions setting is set to Disable (Recommended), the Okta session terminates when the browser window closes. Users must log in to Okta again upon reopening the browser.
What is the behavior when the Okta global session cookies persist across browser sessions setting is enabled?
When the Okta global session cookies persist across browser sessions setting is set to Enable, users remain logged in to the Okta session after closing the browser window, provided the user selects the Keep me signed in checkbox during sign-in. Users can close the browser, reopen it, and navigate to Okta without logging in again.
What are the requirements and behaviors when enabling the persistent cookie setting?
Review the following requirements and behaviors when enabling the persistent cookie setting:
- Only users without administrator permissions can use this feature in OIE. For security reasons, Okta does not maintain administrator sessions.
- The API sets a cookie that lasts across browser sessions. If a user quits and reopens the browser, the browser session persists unless the user signs out.
- The persistent cookie remains valid until the session expires according to the global session policy settings.
- The browser privacy and security policy must allow sites to save data on the device.
- If Keep me signed in fails across closed browser sessions, verify that the browser does not remove the HTTP idx and Dt cookies from storage. Removing these cookies causes Okta to initiate a new session even though the user should remain signed in.
How is the Okta persistent session feature tested?
Run tests using a non-administrator test account by selecting Keep me signed in on the Sign-In Widget and ensuring the global session policy has the option for persisting cookies across browser sessions enabled. Okta does not honor the global session policy setting for persisting cookies across browser sessions for administrators of any type.
