Hello Venu,

I'm not sure what function you are talking about specifically. When I log out of my system with Fiddler running, I see that the JSESSIONID changes when I get to the login screen and the Pega-RULES cookie is set to none. Are you not observing that? Do you have something like SSO set up that may be changing the behavior? How about something like Siteminder or a proxy server that may be "helpfully" remembering your information for you?

Or am I missunderstanding your comment?

Thanks,

Mike

Hi,

Can someone please reply, How can we identify Pega rules cookies and clear them when the user logged off from the session. Please note we are using web sso authentication and pega cookies are not cleared when user logout from pega, so this can allow an attacker to continue accessing the application. Is there any OOTB config or code to identify and clear pega specific cookies from browser?

Thanks,

Venu,

I don't know the answer off the top of my head. Can you run an HTTP debugger, like Fiddler, and see what cookies are being passed? Likewise, if you take a look at the code that runs when you hit the logoff button from a direct session, something in there cleans up the cookie. I believe, at least in older versions of the product, there was a few lines of JavaScript that did that and they resided on the screen that displayed to confirm you were successfully logged out.

Thanks,

Mike