topic Portal OAuth Session Management in ArcGIS Earth Questions https://community.esri.com/t5/arcgis-earth-questions/portal-oauth-session-management/m-p/771567#M85 <HTML><HEAD></HEAD><BODY><P><SPAN>When a user clicks Firefox browser "Back" button from a Portal page, say </SPAN><A class="jive-link-external-small" href="https://community.esri.com/external-link.jspa?url=https%3A%2F%2F%5Bhost%5D%2Farcgis%2Fhome%2Fwebmap%2Fviewer.html%3FuseExisting%3D1" rel="nofollow" target="_blank">https://[host]/arcgis/home/webmap/viewer.html?useExisting=1</A><SPAN>, the token in esri_auth cookie get renewed.&nbsp;&nbsp; Is this a known bug or an intended feature for 10.3.1?</SPAN></P><P>The esri_auth cookie is set to expired per session.&nbsp; Among the variables in the esri_auth, only token is encoded with a secret.&nbsp; Per OAuth2 standard, the token is OAuth session token. Given under normal user usage, including the "back" button or other like actions, the session token is lost and then renewed.&nbsp; During a user session, there are many session tokens instead of one.</P><P>My requirement is to able to audit the activities in detail of a user during a session.&nbsp; I assumed the token in esri_auth is the OAuth session token for a user session so that I can correlate audit logs for a user using the token.</P></BODY></HTML> Tue, 20 Sep 2016 23:26:01 GMT benyau 2016-09-20T23:26:01Z Portal OAuth Session Management https://community.esri.com/t5/arcgis-earth-questions/portal-oauth-session-management/m-p/771567#M85 <HTML><HEAD></HEAD><BODY><P><SPAN>When a user clicks Firefox browser "Back" button from a Portal page, say </SPAN><A class="jive-link-external-small" href="https://community.esri.com/external-link.jspa?url=https%3A%2F%2F%5Bhost%5D%2Farcgis%2Fhome%2Fwebmap%2Fviewer.html%3FuseExisting%3D1" rel="nofollow" target="_blank">https://[host]/arcgis/home/webmap/viewer.html?useExisting=1</A><SPAN>, the token in esri_auth cookie get renewed.&nbsp;&nbsp; Is this a known bug or an intended feature for 10.3.1?</SPAN></P><P>The esri_auth cookie is set to expired per session.&nbsp; Among the variables in the esri_auth, only token is encoded with a secret.&nbsp; Per OAuth2 standard, the token is OAuth session token. Given under normal user usage, including the "back" button or other like actions, the session token is lost and then renewed.&nbsp; During a user session, there are many session tokens instead of one.</P><P>My requirement is to able to audit the activities in detail of a user during a session.&nbsp; I assumed the token in esri_auth is the OAuth session token for a user session so that I can correlate audit logs for a user using the token.</P></BODY></HTML> Tue, 20 Sep 2016 23:26:01 GMT https://community.esri.com/t5/arcgis-earth-questions/portal-oauth-session-management/m-p/771567#M85 benyau 2016-09-20T23:26:01Z