Our security team says we need to modify the cas module so that it either deletes the session cookies when the browser closes or use a session variable rather than a cookie. I can't figure out how to satisfy their requirements. I don't see such a setting in the cas module.

Currently, the cas module auto logs in users even though the Gateway autologin setting is disabled. The security team says this is OK on the first load but after the browser is closed, the site is not reauthenticating but instead relying on the cookie which is not acceptable. I don't know how they know this is what is happening.

I'm using Drupal 8.5.3.

It seems to me that the CAS settings under Configuration -> CAS

Gateway Feature (Auto Login)
when the radio button "disable gateway feature" is checked, that users should be required to login but though this option is checked, they are not required to login.

The cas module READ.md file writes this about the Gateway feature,
"This feature is not currently compatible with any form of page caching."

Page caching is disabled in settings

$settings['cache']['bins']['render'] = 'cache.backend.null';

Dynamic Page cache is also disabled

$settings['cache']['bins']['dynamic_page_cache'] = 'cache.backend.null';

In addition, the CAS settings "Forced Login" is enabled.

php.ini has cookie lifetime set to 0

; Lifetime in seconds of cookie or, if 0, until browser is restarted.

session.cookie_lifetime = 0

Thanks for any help.


I resolved this issue by making the following changes to the following files:


# Set session cookie lifetime (in seconds), i.e. the time from the session
# is created to the cookie expires, i.e. when the browser is expected to
# discard the cookie. The value 0 means "until the browser is closed".
# @default 2000000
cookie_lifetime: 0
  • Page cache also includes the page and dynamic_page_cache bins, you should probably set those to the null backend too. Not sure that will fix the problem but it might
    – Clive
    May 24, 2018 at 15:02
  • Thank you for your reply. I clarified that dynamic page cache is also disabled. May 24, 2018 at 16:14
  • Are you saying you want CAS users to re-authenticate when they come to the site or are you saying you want to only allow authenticated users? E.g. if they are not authenticated with CAS, force them to authenticate first.
    – CG Monroe
    May 24, 2018 at 16:34
  • I want the application to show a "Login" button that the users have to click in order to be authenticated through CAS. It is OK if the authentication happens automatically at that point. This requirement has been dictated by our security team. This is how other sites, created in Drupal 7 work. May 24, 2018 at 16:42

1 Answer 1


Not sure if this would meet your requirements but look at the require_login module. I'v done CAS and Shib authenticated sites using this module.

My solution was to have an excluded custom login page that was set up as the user login path in this module. This page generally had the welcome / security blurb and a button that linked to the Authentication agent (CAS / Shib). I seem to remember having to custom craft this to include the page to return to after login.

The part that might not work for you is that if a user had authenticated via CAS on another site and then came to this site, they did not see this page but where autologged into Drupal.. after all CAS, Shib, and the like are Single Sign On solution.. ;)

This might work for you with the Gateway option off.

Otherwise you might have to look at creating a custom event subscriber that handles the CAS authentication. E.g., if a user logs in and they are a CAS user, send them to the login page. Set some flag on the login page and then allow them to "login".

  • Thank you so much for the guidance. I'll do some investigating. May 25, 2018 at 12:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.