Session and Cookie

The Session Management system provides enterprise-grade session security for mission-critical applications. Maverics sessions are comprehensive containers that hold the complete user context needed for identity orchestration.

A Maverics session encompasses the user’s authentication state, attributes retrieved from multiple identity sources (like Active Directory, databases, or APIs), and any metadata associated with the user’s journey through your applications. Think of it as a secure, ephemeral server-side profile that aggregates everything needed to make intelligent access decisions across your entire infrastructure.

This comprehensive approach enables identity orchestration across hybrid and cloud environments. Organizations can extend cloud identity services like Azure AD to protect legacy on-premises applications, gradually migrate users from outdated identity systems to modern platforms, and create seamless single sign-on experiences that span completely different technologies. Sessions bridge the gap between disparate identity systems while maintaining both security and user experience.

Security Features

Cryptographically Secure Session Identifiers

Session identifiers are generated using a cryptographically secure random number generator (CSPRNG) with 256-bit entropy. This provides:

• 2256 possible session IDs - making brute force attacks computationally infeasible

• Exceeds OWASP recommendations - OWASP requires minimum 64-bit entropy; Maverics has 256-bit entropy

• Zero predictability - each session ID is completely independent and unpredictable

Session Cookie Security

By default, all session cookies are configured with maximum security settings:

• Session Cookies Only - Cookies are automatically deleted when the browser closes (MaxAge = 0)

• HTTPS Only (Secure flag) - Cookies are only transmitted over encrypted connections

• HttpOnly Protection - Prevents client-side JavaScript access to session cookies

• SameSite=None - Enables secure cross-site authentication flows while maintaining protection

These settings help protect against:

• Session hijacking via network interception

• Cross-site scripting (XSS) attacks

• Cross-site request forgery (CSRF) attacks

• Session fixation attacks

Default Session Lifetime

Sessions are configured with secure default timeouts:

• Maximum Session Lifetime: 24 hours

• Idle Timeout: Disabled by default (can be configured)

• Automatic Cleanup: Expired sessions are automatically purged from the backing storage service

This balances security with user experience, ensuring sessions don’t persist indefinitely while minimizing authentication friction for legitimate users.

Session Termination

The Orchestrator can explicitly terminate user sessions to ensure immediate security enforcement and compliance requirements.

Immediate Effects

• All session data is deleted - User attributes, authentication state, and metadata are removed from the session store

• Session cookie is invalidated - The user’s browser receives an expired cookie that will be automatically discarded

• User access is revoked - Any subsequent requests using the terminated session will be denied and end-users will send users back through the authentication and authorizations flows.

Common Termination Scenarios

Session termination occurs automatically in several situations:

• User logout - When users explicitly sign out through your application

• Timeout expiration - Sessions that exceed maximum lifetime or idle timeout limits

Security Benefits

Explicit session termination provides immediate security enforcement:

• Rapid response to security incidents - Compromised accounts can be immediately secured

• Compliance requirements - Meet regulatory standards requiring immediate access revocation

• Zero-trust enforcement - Ensure users must re-authenticate after privilege changes

• Clean session state - Prevents stale authentication data from affecting future access decisions

Session Cookie

The Orchestrator uses a non-persistent session cookie to maintain an end-user’s state. The lifetime of the cookie is determined by the configured maximum lifetime and idle timeout values.

The session cookie is an opaque cookie that contains only a session identifier. The session identifier is generated using a cryptographically secure random number generator with 256-bit entropy. All other session state is maintained on the Orchestrator server rather than being stored in the cookie itself.

A session cookie should be treated like a secret and not shared. If a malicious actor obtains a session cookie, they could potentially impersonate the authenticated user.

Key characteristics of the Maverics session cookie:

• Opaque identifier only - No sensitive data stored in the cookie

• Server-side state management - All user attributes and session data stored securely on the server

• Cryptographically secure generation - 256-bit entropy ensures unpredictable session identifiers

• Configurable cookie attributes - Security settings can be customized while maintaining best practices

Configuration

Maverics sessions include user attributes and orchestration context used to extend cloud identity services to other apps.

Note: Federated identity providers (IDPs) may still hold their own active sessions, which can allow users to re-authenticate silently. To fully log users out across all IDPs, refer to the single logout configuration.

The following parameters for sessions are set in Deployments under Orchestrator Settings.

Session

Cookie Settings