# How to hide session token from login-logout page url

**URL:** <https://forum.inductiveautomation.com/t/how-to-hide-session-token-from-login-logout-page-url/54279>\
**Category:** Ignition\
**Tags:** ignition81\
**Created:** [December 19, 2021, 12:12pm UTC](https://forum.inductiveautomation.com/t/how-to-hide-session-token-from-login-logout-page-url/54279 "2021-12-19T12:12:41Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Wunchut\_Prabsuta](https://avatars.discourse-cdn.com/v4/letter/w/51bf81/32.png) [@Wunchut\_Prabsuta](https://forum.inductiveautomation.com/u/Wunchut_Prabsuta)\
**Post date:** [December 19, 2021, 12:12pm UTC](https://forum.inductiveautomation.com/t/how-to-hide-session-token-from-login-logout-page-url/54279/1 "2021-12-19T12:12:41Z")

</div>

I implement the ignition project that use to provide api gateway on internet. after our IT-security use vulnerability scanner application. I get the vulnerability on this list.

First they told : Session token in URL  
I think the problem is after we login or logout . igniton will generate url that contain session token.  
**example url :**  
http:/myorganizedomain:8088/idp/default/authn/login?token=xxxx  
Question : It is possible to hide this parameter to other way such as cookies or htmlstorage?

Second :Cookies with missing, inconsistent or contradictory properties.

- Cookie without SameSite attribute.  
When cookies lack the SameSite attribute, Web browsers may apply different and  
sometimes unexpected defaults. It is therefore recommended to add a SameSite  
attribute with an appropriate value of either “Strict”, “Lax”, or “None”

Question : How to enable cookies samesite on ignition ?

---

<div class="post-metadata">

**Author:** ![jspecht](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/jspecht/32/6465_2.png) [@jspecht](https://forum.inductiveautomation.com/u/jspecht)\
**Post date:** [December 20, 2021, 8:41pm UTC](https://forum.inductiveautomation.com/t/how-to-hide-session-token-from-login-logout-page-url/54279/2 "2021-12-20T20:41:24Z")

</div>

Which version of Ignition was tested?

> [@Wunchut\_Prabsuta](#):
>
> First they told : Session token in URL  
> I think the problem is after we login or logout . igniton will generate url that contain session token.  
> **example url :**  
> http:/myorganizedomain:8088/idp/default/authn/login?token=xxxx  
> Question : It is possible to hide this parameter to other way such as cookies or htmlstorage?

No, it is not possible. This is not a session token. It's a nonce with a short TTL used to orchestrate the handoff between the internal IdP's OIDC authorization endpoint and the authentication workflow and it is bound to your session which is tracked with a cookie. So long as you are using TLS, you do not have to worry about the session cookie leaking to a MITM. If the token gets logged somewhere, a bad actor would have to use this token immediately before the user consumes it, and they would also have to know your session ID to make use of the token, and at that point you have worse problems to solve.

> [@Wunchut\_Prabsuta](#):
>
> Second :Cookies with missing, inconsistent or contradictory properties.
> 
> - Cookie without SameSite attribute.  
> When cookies lack the SameSite attribute, Web browsers may apply different and  
> sometimes unexpected defaults. It is therefore recommended to add a SameSite  
> attribute with an appropriate value of either “Strict”, “Lax”, or “None”
> 
> Question : How to enable cookies samesite on ignition ?

Which cookies specifically? If it is the `jsessionid` cookie in Ignition, you can enable `SameSite` attribute by setting `ignition.http.session.cookie.same-site.enabled` system prop to `true` in `ignition.conf` as a `wrapper.java.additional` value and restart the gateway. By default, when enabled, the SameSite value will be set to `Strict`. This can be changed by setting system prop `ignition.http.session.cookie.same-site.value` to one of `Strict`, `Lax`, or `None`.