FAQ
Smarter by Design.Simpler for Business
TR7Enterprise Application Delivery & Security Platform

English

Türkçe

English

Türkçe

Appearance

Intermediate

What is a Session Protection Policy; what does it protect the session against? ​

Short answer

A Session Protection Policy is the profile that determines how the sessions opened on an AGS-enabled vService are protected. It carries settings against three risks: a stolen session cookie being used from another client (Session Binding Type: None, IP Address, IP + User Agent, Composite), sessions staying open indefinitely (Session Idle Timeout, default 8 hours; Session Absolute Timeout, default 7 days) and the same account being used simultaneously from many places (Maximum Concurrent Sessions). Each vService uses a single policy; when AGS is first enabled, the built-in Standard Session Protection is assigned to the vService.

How Does It Work? ​

  1. When the user logs in, the session is associated with the value of the selected binding type (the source IP, the source IP together with the User-Agent, or the Smart Variables components selected in Composite).
  2. On subsequent requests the value is calculated again; if it does not match, the request is not considered authenticated and access is not granted. Requests that match Whitelist Conditions are exempted from the binding check.
  3. As activity is seen, the session duration is extended by Session Idle Timeout; a session whose Session Absolute Timeout has elapsed ends regardless of activity.
  4. If the user's number of open sessions exceeds the limit, Action When Max Sessions Exceeded is applied: Deny New Session (default), Logout Oldest Session or Logout All Sessions.

Session Protection Policies in TR7 ​

The policy is defined on the AGS → Protection Policies → Session Protection Policies screen and is selected on the vService in the Flowchart's General Settings window, in the Session Protection Policy field. The built-in profiles do not appear in the list; they are found only in this selector (built-in profiles):

ProfileSession Binding TypeMaximum Concurrent SessionsIdle / absolute timeout
Standard Session ProtectionIP AddressNo Restriction8 hours / 7 days
Strict Session ProtectionIP + User Agent1 (Logout Oldest Session)30 minutes / 8 hours
Relaxed Session ProtectionNoneNo Restriction7 days / 90 days
Single Device SessionIP Address1 (Logout Oldest Session)8 hours / 7 days

In the form, Session Idle Timeout is entered in the range 5 minutes–7 days, Session Absolute Timeout in the range 1 hour–365 days and Maximum Concurrent Sessions, in the Restrict position, in the range 1–100. Open sessions are monitored on the Sessions tab of the vService.

Common Misconceptions ​

  • "IP binding is suitable for every user." For clients whose address changes during the session (mobile networks, corporate proxies that use more than one egress address), IP binding causes the session to be considered invalid; for these user groups, the binding type or Whitelist Conditions are chosen accordingly.
  • "The session never ends as long as the idle timeout has not elapsed." Session Absolute Timeout is the longest lifetime of the session, even if activity continues.
  • "The policy also manages the application's session." The policy is applied only to the AGS session; the session duration of the application on the Backend Service is set in the application.

How it is done in the documentation

Related questions