FAQ - Important - New Logout Strategy

New Local Logout Requirement
A new logout requirement was determined by the business, whereby logging out of an application should not affect other logged in applications. In other words, applications should perform a local logout only. Global Logouts should not be used. If you have a scenario for global logout, please contact us in the slack or support channels. The directions for logout have been updated.

Unique session or cookie identifiers
In addition, there should be a unique session id (or unique cookie name) per tab. In the past, we advised that cookies should be based on your clientID. The new change is that the naming convention should be unique, so we recommend clientID + some unique string. The directions for cookie naming have been updated.

Impact on Cognito SSO Cookie
With applications performing local application logouts only, the Cognito SSO cookie will be deleted when the local application logout is performed.

Example Diagram of Logout Strategy

Known Use Cases for Global Logout

USTA.com

• Update Email from Sign In user dashboard

  • A global logout is performed to keep email field in ID Token up to date

  • Proposal: Will display a message to the user that this operation will log them out of all applications.
    https://files.slack.com/files-pri/TBYMZNWH2-F015JJV71RV/global_logout_mockup.png

    • Edit: Including TennisLink and ServeTennis

• Profile Page, change DOB < 13, confirmation, Global Logout

• ASM - CSR ends the session, Global Logout

  • Button in Back Office (End Session, Left Pane) → Must use logout from this button → Global Logout

    • Nice to Have: Website Logout (Possible to detect if the user is in ASM group), work needed (20.7?) (All Clients?)

All Clients

• Cancel Light Weight Registration

  • As previously advised, If a user cancels lightweight registration, please perform a global logout.

Potential Issues

• Multiple Tabs Cognito internal cookies (retest this, not with Toy App)