Security setting: clear session on browser close

Updated last month

Overview

Simpplr provides a security setting that lets administrators make key web session cookies non-persistent. When it is turned on, users are signed out once they completely close their browser, and they must sign in again the next time they open Simpplr. This helps protect against unintended access on shared or public computers, where a persistent session could otherwise be reused by the next person.

Who this is for

This setting is aimed at administrators and App managers who want stronger sign-in security for their organization. It is especially useful for:

organizations with shared or public workstations, such as kiosks, hospital stations, front desks, and lab machines,
teams that want stronger protection against unintended reuse of an open browser session, and
organizations that prefer shorter browser session persistence for security or compliance reasons.

What the setting does

By default, Simpplr login cookies are long-lived, so a signed-in session can survive closing and reopening the browser. When the setting is enabled, the key authentication cookies (token and ftoken) and the CSRF cookie (csrfid) are created as session cookies instead of persistent cookies. As a result, the session no longer survives a full browser close, and the user is asked to authenticate again.

This behavior applies to the Simpplr web experience only. Mobile behavior is different and is not controlled by this setting. Authentication itself is unchanged: users continue to sign in through your configured method, including SSO if it is enabled. The setting only controls whether the web session persists after the browser is closed.

Enabled vs. disabled

The table below summarizes how the two states differ.

Setting enabled	Setting disabled
Authentication cookies (token, ftoken) and the CSRF cookie (csrfid) are created as session cookies.	The same cookies are created as long-lived persistent cookies.
Closing the browser completely ends the active session.	Closing the browser may not end the session immediately.
Reopening the browser prompts the user to sign in again (through your configured method, including SSO).	Users may remain signed in until they explicitly sign out or the session expires under your organization's policy.
Applies to the Simpplr web experience only. Mobile behavior is unchanged.	Applies to the Simpplr web experience only. Mobile behavior is unchanged.

How to enable it

An App manager can turn the setting on from the admin console:

Sign in as an App manager
Go to Manage application
Open the Security tab
Go to Session settings
Turn on Clear session on browser close (the exact wording may vary slightly).
Save your changes.

After you enable the setting, ask users to sign out once and sign back in so that the new cookie behavior applies to their next session. Existing sessions created before the change may continue to follow the old persistence behavior until the user re-authenticates.

This option depends on the enable_non_persistent_cookies feature flag being enabled for your environment. If you do not see the setting under Session settings, contact Simpplr Support to have it enabled.

What users should expect

If users fully close the browser (all windows) and reopen it, they will usually be asked to sign in again.
If users only close a single tab rather than the whole browser, behavior may differ and the session may persist.
If the browser is configured to restore the previous session on startup, cookie behavior can vary by browser implementation.

The sign-out is typically triggered when the entire browser is closed, not just a single Simpplr tab.

Troubleshooting

Users are still signed in after closing the browser

Confirm the browser was fully closed (all windows), not just the Simpplr tab.
Ask the user to sign out once, then sign back in so the new session follows the updated policy.
Check whether the browser restores previous sessions on startup, as this can vary the behavior.

Users are being prompted to sign in too often

If the setting adds too much friction, consider whether you want it enabled for all users or only for specific groups, such as shared-device teams, or only during certain periods. You can disable the setting at any time from the same location in Session settings.

Frequently asked questions

Q: Does this affect SSO?

Ans: No. Users still authenticate through your configured sign-in method, including SSO if enabled. This setting only controls whether the web session persists after the browser is closed.

Q: Is this the same as an idle timeout?

Ans: No. An idle timeout signs users out after a period of inactivity. This setting signs users out when the browser is closed, regardless of how active the session was.

Q: Does it apply to mobile?

Ans: No. The setting controls the Simpplr web experience only. Mobile session behavior is handled separately and is not affected by this option.