DocumentationExperience Cloud KCS

Understand session management and cookie security controls in AEM as a Cloud Service

Last update: September 9, 2026

This article explains how session management, cookie security attributes, concurrent sessions, idle timeout, and rate limiting work in AEM as a Cloud Service environments that use Adobe IMS for authentication. To fix this, review which controls are managed by AEM, Adobe IMS, your identity provider, Adobe Cloud Manager, or Adobe, and configure each control through its supported management layer.

Description description

Environment

  • Adobe Experience Manager as a Cloud Service
  • Adobe IMS authentication
  • Adobe Admin Console and Adobe Cloud Manager security controls

Issue/Symptoms

  • Logging out of AEM clears the local application session, but the Adobe IMS SSO session remains active while it is valid. Users can reenter AEM without reauthenticating.
  • Users can maintain multiple concurrent authenticated sessions because AEM does not provide a built-in single-session restriction.
  • Security reviews can flag platform-managed cookies such as login-token, cq-authoring-mode, cq-assets-*, AMCV_*, and affinity for missing or insufficient Secure, HttpOnly, or SameSite attributes.
  • Idle-session behavior involves both AEM and IMS token lifetimes, which creates different local-session and SSO-session expiration behavior.
  • AEM as a Cloud Service provides baseline rate limiting and DDoS protection, while additional traffic-filter and WAF controls require configuration and, for WAF rules, the applicable security entitlement.

Cause

These behaviors are part of the AEM as a Cloud Service and Adobe IMS authentication model. AEM does not provide every security control at the application level. Session concurrency and stricter idle-session requirements are managed through the identity provider, Adobe IMS authentication policies, or endpoint controls. Adobe manages platform cookies and the underlying service-level security controls.

Resolution resolution

Follow the steps below to review and configure the applicable security controls:

  1. Log out of Adobe Experience Manager as a Cloud Service. When the security policy requires the Adobe IMS SSO session to end, use the applicable direct Adobe IMS or identity-provider logout flow. An AEM logout clears the local application session but doesn’t automatically terminate the IMS SSO session. Users remain authenticated until the IMS session expires or they log out directly through Adobe IMS. AEM doesn’t automatically trigger a global IMS logout for every AEM logout.

  2. Configure single-session enforcement in the identity provider or through endpoint and device security policies when users must have only one active session. Adobe Experience Manager and Adobe IMS don’t provide single-session enforcement by default. AEM honors the authentication decisions made by Adobe IMS and the identity provider.

  3. Review the security attributes of the platform cookies:

    • The login-token cookie uses the Secure and HttpOnly attributes.
    • Adobe manages other platform cookies, including cq-* cookies such as cq-authoring-mode and cq-assets-, as well as AMCV_ and affinity. Don’t attempt to modify these cookies directly.
    • When cross-site authentication requires a different SameSite value for login-token, use the documented AEM configuration instead of modifying the cookie at runtime.

  4. Configure stricter idle-session requirements in the applicable identity-provider or Adobe IMS authentication policy, and apply endpoint controls such as operating system or virtual desktop infrastructure session timeouts when required. AEM’s token timeout is enforced, but the Adobe IMS SSO session can allow a new AEM session to be established without reauthentication while the IMS token remains valid. Adobe Experience Manager as a Cloud Service doesn’t override the IMS token lifetime or provide an independent AEM-level idle timeout for the IMS session.

  5. Use Cloud Manager to review and configure the available Traffic Filter Rules and IP Allow Lists. AEM as a Cloud Service provides baseline DDoS protection and rate limiting by default. Standard traffic-filter rules provide request-filtering and rate-limiting controls. Advanced WAF traffic-filter rules require the applicable Extended Security entitlement.

  6. Review the identity-provider, endpoint, and Cloud Manager security policies to confirm that they meet your organization’s session-management requirements.

Notes:

  • Logging out of Adobe Experience Manager and logging out of Adobe IMS are separate operations because they terminate different sessions.
  • Cookie attributes are controlled according to the cookie type and the supported Adobe configuration for that cookie. Don’t attempt to rewrite Adobe-managed cookies in the browser or at the AEM runtime.
recommendation-more-help
experience-cloud-kcs-help-kbarticles