Session tracking modes and configuration

Session tracking for Airlock IAM sessions can be configured in Airlock Gateway via session cookies or header tokens.

• Cookie-based session tracking is the default solution for most browser-based applications. It requires cookie-handling capabilities in the browser (or mobile application).
• In cases where cookie session tracking cannot be used, i.e., because cookie handling is unavailable, HTTP header-based session tracking can be configured instead.

Historically, Airlock IAM could be configured to generate header tokens for session tracking, but this is no longer a supported solution. As of Airlock Gateway 8.1, IAM-generated header tokens are no longer supported.

The following table lists the possible configuration options with different Airlock IAM and Airlock Gateway release versions:

• Internal links:
• Session tracking in the IAM flow concept
• Using gateway-generated cookies for session tracking
• Using header tokens for session tracking
• HTTP request authentication (Airlock One-Shot flow)
• Airlock Gateway for Airlock IAM configuration

• External link:
• IAM header token (IAM 7.7)