WSO2 Authentication - Difference between JSESSIONID and RememberMeDataValue

Question

When logging in, into WSO2 Identity Server using the SOAP AuthenticationAdmin, I can choose to use the 'loginWithRememberMeOption'. When using this option, the Identity Server will provide a 'RememberMeDataValue'. For instance:

admin-26d5de4f-c243-4141-acbf-2513f99174cd

I can use this value in the 'loginWithRememberMeCookie', that will tell me 'true' if the value was indeed generated.

However, as I understand it, a more common way to 'remember' a user is by using the session cookie. In this case, also supplied in the response of the Identity Server.

Set-Cookie: JSESSIONID=94784CC9FC03E9FA3822CFDDAD0D36F6; Path=/; Secure; HttpOnly

What is the difference between these two values?

Answer 1

The JSESSIONID cookie will only be valid for a particular session and it will be invalid when the session times out.

However when you are using the remember me option, you can login with the remember me cookie even if the initial session has timed out.