We occasionally deploy our SSO system with some major changes. As much as we try to minimize it, on occasion we have require our users to delete all their "old" cookies. This is because their cookies refer to old session data from the previous SSO version.

Is there are common way to handle this making it more seamless for users? I am considering the following:

1) Store a version cookie e.g. "sso_version=1.5", when the user accesses our SSO site, the system will detect that their cookies are old, and remove them. Thereafter new cookies will be set referring to current sessions. We would only remove cookies on this occasion.

2) Instead we rename the cookies - "token_1-5", "token_1-6" etc .. this way seems to require more changes to the environment and configuration (cookie names are stored there) though.

Are any of these methods in common usage? Or is there an alternative (better) method for doing this?

  • Just stating the obvious: the former approach causes a problem if the older version can still be accessed somehow (i.e. the older version will have to drop the newer cookies too); whereas the latter approach will allow the older version to continue to work, with the slight waste of cookie storage on the client with stale cookies hanging around if they don't access the old version again.
    – Mark Hurd
    Sep 16 '15 at 7:16
  • The older version won't be accessible, the new version would completely replace it. We have token cookie names in config so we would be able to change the name, we don't name it in multiple places, eventually the old cookies would expire.
    – Martyn
    Sep 16 '15 at 8:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.