---
title: Configure client-side sessions
description: Client-side sessions require additional setup in your environment to keep the sessions safe, and to ensure both the browser and the web server where AM runs can manage large cookies. Additionally, some of the AM features cannot be used with client-side sessions. Review the following list before configuring client-side sessions:
component: pingam
version: 7.3
page_id: pingam:sessions-guide:impl-client-based-sessions
canonical_url: https://docs.pingidentity.com/pingam/8.1/am-sessions/impl-client-based-sessions.html
llms_txt: https://docs.pingidentity.com/pingam/llms.txt
docs_for_agents: https://developer.pingidentity.com/build-with-ai/docs-for-agents.md
keywords: ["Sessions", "Authentication", "CTS Store (Sessions & Tokens)", "Setup & Configuration", "Storage"]
section_ids:
  proc-configure-client-based-auth-sessions: Configure client-side authentication sessions
  proc-configure-client-based-sessions: Configure client-side sessions
---

# Configure client-side sessions

Client-side sessions require additional setup in your environment to keep the sessions safe, and to ensure both the browser and the web server where AM runs can manage large cookies. Additionally, some of the AM features cannot be used with client-side sessions. Review the following list before configuring client-side sessions:

Planning for client-side sessions

* Ensure the trust store used by AM has the necessary certificates installed:

  * A certificate is required for encrypting JWTs containing client-side sessions.

  * If you are using RS256 signing, then a certificate is required to sign JWTs. (HMAC signing uses a shared secret.)

  The same certificates must be stored on all servers participating in an AM site. For more information about managing certificates for AM, see [Secrets, certificates, and keys](../security-guide/secrets-certs-keys.html).

* Ensure that your users' browsers can accommodate larger session cookie sizes required by client-side sessions. For more information about session cookie sizes, see [Session cookies and session security](session-state-cookies.html).

* Ensure that the AM web container can accommodate an HTTP header that is 16K in size or greater. When using Apache Tomcat as the AM web container, configure the `server.xml` file's `maxHttpHeaderSize` property to `16384` or higher.

* Ensure that your deployment does not require any of the capabilities specified in the list of limitations that apply to client-side sessions.

  > **Collapse: Limitations of client-side sessions**
  >
  > Client-side sessions cannot use the following functionality:
  >
  > * [Session quotas](../security-guide/session-quotas.html)
  >
  > * [Session idle timeout](../security-guide/session-state-session-termination.html)
  >
  > * [Cross-domain single sign-on with restricted tokens](../security-guide/enable-cdsso-cookie-hijacking-protection.html) (web agents and Java agents)
  >
  > * [Session signing and encryption](../security-guide/session-state-configure-cookie-security.html#policy_agent5_client-based) (web agents and Java agents)
  >
  > * [Uncompressed sessions](../security-guide/session-state-configure-cookie-security.html#policy_agent5_client-based) (web agents and Java agents)
  >
  > * [SAML 2.0 single logout using the SOAP binding](../saml2-guide/saml2-configuration.html#saml2-and-session-state)
  >
  > * [SNMP session monitoring](../maintenance-guide/snmp-monitoring.html#snmp-sessions)
  >
  > * [Session management using the AM admin UI](managing-sessions-console.html)
  >
  > * [Session notification](../reference/global-services-configuration.html#global-session)
  >
  > * [Refresh token grace period](../oauth2-guide/oauth2-refresh-tokens.html#refresh-token-grace-period)

## Configure client-side authentication sessions

|   |                                                                                                                                                                                                                                                            |
| - | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
|   | Configuring storage location for authentication sessions is only supported for authentication trees. Authentication chains always store authentication sessions in AM's memory. For more information, see [Introduction to sessions](about-sessions.html). |

1. In the AM admin UI, go to Realms > *Realm Name* > Authentication > Settings > Trees.

2. From the Authentication session state management scheme drop-down list, select `JWT`.

3. In the Max duration (minutes) field, enter the maximum life of the authentication session in minutes.

4. Save your changes.

5. Go to Configure > Authentication > Core > Security.

6. In the Organization Authentication Signing Secret field, enter a base64-encoded HMAC secret that AM uses to sign the JWT that is passed back and forth between the client and AM during the authentication process. The secret must be at least 128-bits in length.

7. Save your changes.

8. Protect your client-side authentication sessions.

   See [Client-side session security](../security-guide/session-state-configure-cookie-security.html).

## Configure client-side sessions

1. In the AM admin UI, go to Realms > *Realm Name* > Authentication > Settings > General.

2. Select the Use Client-Side Sessions check box.

3. Save your changes.

4. Protect your client-side sessions. See [Client-side session security](../security-guide/session-state-configure-cookie-security.html).

5. Verify that AM creates a client-side session when non-administrative users authenticate to the realm.

   Perform the following steps:

   * Authenticate to the AM admin UI as the top-level administrator (by default, the `amAdmin` user). Note that sessions for the top-level administrator are always stored in the CTS token store.

   * Go to Realms > *Realm Name* > Sessions.

   * Verify that a session is present for the `amAdmin` user.

   * In your browser, examine the AM cookie, named `iPlanetDirectoryPro` by default. Copy and paste the cookie's value into a text file and note its size.

   * Start up a private browser session that will not have access to the `iPlanetDirectoryPro` cookie for the `amAdmin` user:

     * In Chrome, open an incognito window.

     * In Microsoft Edge, start InPrivate browsing.

     * In Firefox, open a new private window.

     * In Safari, open a new private window.

   * Authenticate to AM as a non-administrative user in the realm for which you enabled client-side sessions. Be sure *not* to authenticate as the `amAdmin` user this time.

   * In your browser, examine the `iPlanetDirectoryPro` cookie. Copy and paste the cookie's value into a second text file and note its size. The size of the client-side session cookie's value should be considerably larger than the size of the cookie used by the server-side session for the `amAdmin` user. If the cookie is not larger, you have not enabled client-side sessions correctly.

   * Return to the original browser window in which the AM admin UI appears.

   * Refresh the window containing the Sessions page.

   * Verify that a session still appears for the `amAdmin` user, but that no session appears for the non-administrative user in the realm with client-side sessions enabled.