Sessions and changes
Understand session duration, policy changes, and logout.
Session lifetime
Each application sets a session duration from 300 to 86400 seconds, or five minutes to 24 hours. A session is tied to its hostname, application, and saved configuration.
Configuration changes
Saving Zero Trust invalidates existing sessions as the update takes effect across the service. Visitors must sign in again. Allow time for the change to apply before testing a new policy.
Suspending an account at the identity provider takes effect at the next provider login. To revoke access during an existing Loclix session, update the application's access policy.
An established WebSocket keeps the access decision made when it connected. A policy change does not recheck that connection.
Logout
From your application, send a same-origin POST to /_loclix/access/logout with the exact application Origin header.
This clears the browser's Loclix application cookies for that hostname. It does not sign the visitor out of their identity provider or invalidate copies of the cookie elsewhere.
Cache behavior
Shared caching and fragment composition are bypassed for the whole website while Zero Trust is configured. Protected responses use Cache-Control: private, no-store.