LTPA 令牌不变
当我在 WebSphere 上注销应用程序并重新登录时，LTPA 令牌没有变化。我认为它会改变，因为会话令牌应该是不可预测的。
When I log out of an application on WebSphere and back on, the LTPA token is unchanged. I thought it would change because session tokens are supposed to be unpredictable.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
注销时，会话 cookie (JSESSIONID) 在多个产品版本上不会更改。这是因为未经身份验证的用户也可能有会话。那里没有实际问题。 SSO cookie（LTPAKEY 和 LTPAKEY2）将在任何正确注销后失效。
您的应用程序也可能有错误。在这种情况下，您所拥有的是系统中内置的自定义身份验证系统，而没有正确考虑 WebSphere Application Server 提供的机制。应用程序可能应该要求真正的失效，对于 示例。
Session cookies (JSESSIONID) do not change on several product versions when logging out. This is because unauthenticated users may also have sessions. There is no actual problem there. The SSO cookies (LTPAKEY and LTPAKEY2) will get invalidated on any proper logout.
It is also possible that your application is faulty. In that case what you have is a custom authentication system built into your system not taking into account the WebSphere Application Server provided mechanisms properly. The applications should probably call for real invalidation, for example.
当您退出应用程序时，您会做什么？
您是否正在使 LTPA cookie 失效？
如果没有，浏览器具有 LTPA cookie，它告诉 APp 服务器您已通过身份验证。
不要假设会话 ID 和 HTTP 会话以及 LTPA 是一样的。
What do you when you log out of your application?
Are you invalidating the LTPA cookie?
If not, the browser has the LTPA cookie which tell the APp Server that you are authenticated as far as it is concerned.
Do not assume that session ID and HTTP Sessions and LTPA are one and the same.