Okta must be configured to disable persistent global session cookies.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
| V-273206 | OKTA-APP-001710 | SV-273206r1098885_rule | Medium |
| Description |
| If cached authentication information is out of date, the validity of the authentication information may be questionable. Satisfies: SRG-APP-000400, SRG-APP-000157 |
| STIG | Date |
| Okta Identity as a Service (IDaaS) Security Technical Implementation Guide | 2025-05-06 |
Details
| Check Text (C-77297r1098883_chk) |
| From the Admin Console: 1. Select Security >> Global Session Policy. 2. In the Default Policy, verify a rule is configured at Priority 1 that is not named "Default Rule". 3. Click the "Edit" icon next to the Priority 1 rule. 4. Verify "Okta global session cookies persist across browser sessions" is set to "Disabled". If the above it not set, this is a finding. |
| Fix Text (F-77202r1098884_fix) |
| From the Admin Console: 1. Go to Security >> Global Session Policy. 2. Select the Default Policy. 3. In the "Rules" table, make these updates: - Click "Add rule". - Set "Okta global session cookies persist across browser sessions" to Disable. |