Internet Authorization Issues,

[SBraisted]

I have a user who has access to clients bank accounts, and some of these banks require authorization to prove that she in fact should have access to said accounts. The issue is that periodically, some of these banks seem to "forget" that she's been authorized, which requires her to coordinate with our clients to get reauthorized, quite frankly it is becoming a hassle. Her computer has not been deleting cookies, which was my first guess, but now I have no idea what could be causing this, if it is in fact on our end.

Is this something that others have seen before? A computer "forgetting" that it's been authorized by a website to access sites? I appreciate all suggestions.

 

[UsernameIssues]

Welcome to the Seven Forums.

Perhaps I'm not understanding the situation and I'm not an expert in methods of authentication. But from a practical standpoint, she should be able to authenticate using any computer. Cookies from a past session can make authentication easier for future sessions (e.g. fewer steps during the authentication process), but they should never be required for future sessions.

If your website requires that one or more cookies to be set during one session, then it should warn the user if those cookies were not properly created/saved/accessed during that one session. If your website requires that the browser accepts "3rd party cookies" (which is a bad idea), then perhaps her security suite is find/fixing the setting that accepts those types of cookies. But again, your website should warn if a cookie is not set.

 

[pippin]

I'm no expert at this sort of thing either but I agree with UsernameIssues, It shouldn't matter if the cookies are deleted or not. And I don't think its her computer forgetting. perhaps its a schannel problem which has to do with administrative web authentications. or maybe its a server problem on the banks side?

 

[A Guy]

Often sites will set an ip address as being the owners computer. Accessing from another ip address triggers a request for an authorization. It is possible that there is a time limit after which it is triggered again. This would be a security feature of the bank, and it would be unlikely they would discuss how it works, or what limits it may have. A Guy