← Back to Okta Identity as a Service (IDaaS) Security Technical Implementation Guide

V-273206

CAT II (Medium)

Okta must be configured to disable persistent global session cookies.

Rule ID

SV-273206r1098885_rule

STIG

Okta Identity as a Service (IDaaS) Security Technical Implementation Guide

Version

V1R2

CCIs

CCI-002007 CCI-001942

Discussion

If cached authentication information is out of date, the validity of the authentication information may be questionable. Satisfies: SRG-APP-000400, SRG-APP-000157

Check Content

From the Admin Console:
1. Select Security >> Global Session Policy.
2. In the Default Policy, verify a rule is configured at Priority 1 that is not named "Default Rule".
3. Click the "Edit" icon next to the Priority 1 rule.
4. Verify "Okta global session cookies persist across browser sessions" is set to "Disabled".

If the above it not set, this is a finding.

Fix Text

From the Admin Console:
1. Go to Security >> Global Session Policy.
2. Select the Default Policy.
3. In the "Rules" table, make these updates:
    - Click "Add rule".
    - Set "Okta global session cookies persist across browser sessions" to Disable.