Signing Out and Session Management in 2023

on YouTube ↗48m

" summary

Common sign‑out methods relying on iframes and third‑party cookies stop working as browsers block third‑party cookies, breaking front-channel logout and iframe session management flows for web, SPAs and tokens. Practical alternatives are server‑to‑server back‑channel logout, CNAME custom domains (limited and brittle), and eventing via shared signal frameworks; back‑channel requires storing session IDs and reachable endpoints and fails if relying parties sit behind firewalls. Actionable steps: inventory session artifacts (cookies, tokens, mobile), implement back‑channel where feasible, and test edge cases.

AI-written summary · about

" chapters (6)

1. 0:00Introduction to session management
2. 3:59What does sign out mean
3. 11:59Traditional sign out flows
4. 21:57Modern techniques and challenges
5. 32:12Looking ahead and next steps
6. 35:03Q&A session

" related talks

• 44mThe Future of CookiesAnders Abel · NDC London 2024
• 53mThe Future of CookiesAnders Abel · NDC Oslo 2023
• 16mInnovation in Authentication and MoreChris Anderson, Matthew Miller · Authenticate 2024
• 01h 01mBuilding Clients for OpenID Connect/OAuth 2-based SystemsDominick Baier · NDC Copenhagen 2019
• 22mO Single Sign-Off, Where Art Thou? An Empirical Analysis of Single Sign-OnMohammad Ghasemisharif · USENIX Security '18
• 50mSecure Authentication and Session ManagementPatrycja Wegrzynowicz · JavaDay Kyiv 2015
• 01h 02mUsing the BFF pattern to secure SPA and Blazor ApplicationsDominick Baier · NDC Oslo 2021
• 50mThe Future of CookiesAnders Abel · NDC Security 2024