Our security team says we need to modify the cas module so that it either deletes the session cookies when the browser closes or use a session variable rather than a cookie. I can't figure out how to satisfy their requirements. I don't see such a setting in the cas module.
Currently, the cas module auto logs in users even though the Gateway autologin setting is disabled. The security team says this is OK on the first load but after the browser is closed, the site is not reauthenticating but instead relying on the cookie which is not acceptable. I don't know how they know this is what is happening.
I'm using Drupal 8.5.3.
It seems to me that the CAS settings under Configuration -> CAS
Gateway Feature (Auto Login)
when the radio button "disable gateway feature" is checked, that users should be required to login but though this option is checked, they are not required to login.
The cas module READ.md file writes this about the Gateway feature,
"This feature is not currently compatible with any form of page caching."
Page caching is disabled in settings
$settings['cache']['bins']['render'] = 'cache.backend.null';
Dynamic Page cache is also disabled
$settings['cache']['bins']['dynamic_page_cache'] = 'cache.backend.null';
In addition, the CAS settings "Forced Login" is enabled.
php.ini has cookie lifetime set to 0
; Lifetime in seconds of cookie or, if 0, until browser is restarted.
session.cookie_lifetime = 0
Thanks for any help.
I resolved this issue by making the following changes to the following files:
# Set session cookie lifetime (in seconds), i.e. the time from the session # is created to the cookie expires, i.e. when the browser is expected to # discard the cookie. The value 0 means "until the browser is closed". # @default 2000000 cookie_lifetime: 0