The article presents the behavior when enabling Okta global session cookies persist across browser sessions.
- Global Session Policy
- Okta Global Session Cookies Persist Across Browser Sessions
- Okta Identity Engine (OIE)
If "Okta global session cookies persist across browser sessions" is set to Disable (Recommended), the expected behavior is for the Okta session to be terminated when the browser window is closed. If the user closes their browser, they will be required to log in to Okta again upon opening it.
If "Okta global session cookies persist across browser sessions" is set to Enable, users can remain logged in to their Okta session even after closing the browser window, provided the "Keep me signed in" checkbox is checked during sign-in. The user can close their browser, reopen it, and navigate to Okta without having to log in again.
If the Okta global session cookies persist across browser sessions is set to Enable. Please note the following:
- The API sets a cookie that lasts across browser sessions. If a user quits their browser and reopens the browser, the browser session persists unless the user has signed out.
- The persistent cookie is valid until the session expires according to settings in the global session policy.
- Persistent cookies are never set for Okta admins.
- The Browser Privacy and Security policy must allow sites to save data on the device.
The above steps do not apply in the Okta Identity Engine (OIE), as the feature has been changed, and it displays as Keep me signed in in the Sign In Widget.
NOTE:
- If Keep me signed in is not working across closed browser sessions, verify that the HTTP idx and Dt cookies are not being removed from storage, causing Okta to initiate the establishment of a new session even though the user should remain signed in according to configuration.
- Only Users without any Admin Permissions will be able to use this feature in the Okta Identity Engine. For security reasons, Admin sessions will not be maintained.
Tests need to be run using a non-admin test account, selecting “Keep me signed in” on the sign-in widget, and having a Global session policy with the option for persisting cookies across browser sessions Enabled. The global session policy setting for persisting cookies across browser sessions is not honored for admins of any type.
