We occasionally deploy our SSO system with some major changes. As much as we try to minimize it, on occasion we have require our users to delete all their "old" cookies. This is because their cookies refer to old session data from the previous SSO version.
Is there are common way to handle this making it more seamless for users? I am considering the following:
1) Store a version cookie e.g. "sso_version=1.5", when the user accesses our SSO site, the system will detect that their cookies are old, and remove them. Thereafter new cookies will be set referring to current sessions. We would only remove cookies on this occasion.
2) Instead we rename the cookies - "token_1-5", "token_1-6" etc .. this way seems to require more changes to the environment and configuration (cookie names are stored there) though.
Are any of these methods in common usage? Or is there an alternative (better) method for doing this?