When you authenticate via CUWebLogin, web "cookies" are used to store your credentials. This is what allows you to access subsequent sites (or other areas of the same site) without needing to type in your NetID and Password again. While this is very convenient for the user, it can also be dangerous if you leave your computer while the "cookies" are active -- someone else could walk up to the computer you were just using (either in a lab setting or at your desk/office) and access sites and services as YOU!
The only way to protect against someone accessing sites and services as you when you walk away from a computer is to CLOSE ALL BROWSER WINDOWS and QUIT THE BROWSER. Your credentials are stored in "session cookies" (cookies stored in memory, not on the hard disk) which are always cleared out when the browser quits.
How do you make sure you have closed your browser so that your CUWebLogin credentials are cleared?
| On Windows or UNIX/Linux | On Mac OS |
|---|---|
| You must make sure that all browser windows are closed. When the last browser window is closed, all session cookies (and thus your CUWebLogin credentials) are cleared. | Choose "Quit" to exit your browser, and all session cookies (and thus your CUWebLogin credentials) are cleared. Under Mac OS X you can find "Quit" in the leftmost menu on the toolbar; under Mac OS 9, "Quit" usually appears in the "File" menu. |
The CUWebLogin Single-Sign-On (SSO) window lets you know that
you have CUWebLogin credentials established. It reminds you that you must exit
your browser to clear credentials. It is important to remember that
simply closing the SSO window WILL NOT CLEAR YOUR CREDENTIALS. When
you see the SSO window with your NetID inside, you should not be prompted for
your NetID and Password again for 8 hours from the time at which you established
the credentials. The only exception would be when visiting sites which want
to verify that you are actually sitting in front of the machine by forcing you
to type your NetID and Password in again before gaining access to that site.
This protects against someone else taking advantage of credentials which may
have been left active by a user who walked away from a machine without clearing
the credentials.