What is session denylisting used for?

The session denylist is a security mechanism used to ensure that logouts are immediately effective. When a user logs out, their session ID is added to the denylist. If PingAM later receives a request with a session ID that is on this list, it will reject the session as invalid, even if the session's expiration time has not yet been reached. This prevents the replay of a stolen session cookie after the legitimate user has explicitly logged out, closing a critical security window.

A: Session inactivity is managed by the idle timeout property of a session, not the denylist.

B: Restricted sessions refer to sessions bound to an IP address, a separate feature from the denylist.

D: Absolute session timeouts are managed by the maximum session time property, which causes sessions to be purged upon expiry.

Ping Identity, PingAM Documentation, "Session Management," Chapter: "Session denylist service." The documentation states: "The session denylist service stores information about logged out sessions... When a user logs out, AM adds their session to the denylist. When a request arrives with a session from the denylist, AM considers it invalid."