Le 09/04/2021 à 18:33, Mike Jumper a écrit : > On Fri, Apr 9, 2021 at 6:55 AM Philippe MARASSE > <[email protected]> wrote: > > Hello, > > I was wondering why guacamole uses localStorage (which is persistent > across browser restarts) instead of sessionStorage ? > > > Just like most web-based services that leverage cookies for the same > functionality, Guacamole uses localStorage so that this data /is/ > persistent across browser restarts. If a user explicitly logs out of > Guacamole, then their session should be immediately ended. If the user > does not log out of Guacamole, they should be able to resume their > session so long as they continue using Guacamole before their session > automatically expires. So it's not a bug, it's a feature ;-). I just wanted to be sure that the actual behavior was intentional, that's fine :-). > > As a user, I expect that when I close my browser, all authentication > data should be deleted too but it's not true with guacamole. The only > way to do that is to enable "clear all cookies and site's data" from > browser preferences. > > > If you want to ensure that web sessions do not resume when you reopen > a tab, restart the browser, etc. you need to either log out of those > services or configure your browser to clear cookies, etc. upon exit. > This goes for Guacamole a well: you need to either log out or > configure your browser to do it for you. If you do not log out, your > session will still automatically expire after a period of time elapses > without any activity (one hour by default). The one issue we have is with CAS authentication : at this time, we cannot log out of guacamole only. I've seen some JIRA issues about Single Log Out, but I was wondering if I can insert a logout view instead of doing standard logout that brings user to the login page => CAS Login => autologin, so logout is pretty impossible at this time.
If it's possible, I think I need some directions to do that. I've already modified CAS authentication in order to choose the ticket validation method via a configuration property, I can share this modification if someone is interested in. Thank you. Rgds. > > Michael Jumper > CEO, Lead Developer > Glyptodon Inc <https://glyp.to/>. -- Philippe MARASSE Responsable pôle Infrastructures - DSIO Centre Hospitalier Henri Laborit CS 10587 - 370 avenue Jacques Cœur 86021 Poitiers Cedex Tel : 05.49.44.57.19
