--- title: Why SSO Sucks and the future of SSO | daily.dev description: An exploration of why single sign-on (SSO) fails to deliver a truly 'single' login experience across web apps, SPAs, CLI tools, and mobile apps, driven by... canonical: https://daily.dev/posts/why-sso-sucks-and-the-future-of-sso-njpp1vcp7 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Why SSO Sucks and the future of SSO | daily.dev og:description: An exploration of why single sign-on (SSO) fails to deliver a truly 'single' login experience across web apps, SPAs, CLI tools, and mobile apps, driven by... og:url: https://daily.dev/posts/why-sso-sucks-and-the-future-of-sso-njpp1vcp7 og:image: https://api.daily.dev/og/posts/nJPp1VcP7.png og:image:alt: Why SSO Sucks and the future of SSO og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Why SSO Sucks and the future of SSO **[Teleport](https://daily.dev/sources/teleport)** · 10 min read · 0 upvotes · 0 comments ## Summary An exploration of why single sign-on (SSO) fails to deliver a truly 'single' login experience across web apps, SPAs, CLI tools, and mobile apps, driven by differing session, token, and architecture requirements across app types. Covers how Teleport uses Okta and Terraform for identity management, discusses SAML/OIDC integration challenges, CSRF risks in SPAs, AWS SSO credential caching, and emerging approaches like Chrome profiles, Chromebooks with Advanced Protection, and passwordless methods (Touch ID, Windows Hello). Argues that certificate-based authentication using client certificates and PKI, encoding identity and session duration, could eventually reduce repeated logins, though current PKI UX remains poor. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### Why do I have to log in with SSO multiple times a day even though it's supposed to be 'single' sign-on? Each application controls its own login process and has a different architecture, so there is no standardized flow that works across all apps. Web apps use server or client-side sessions with timeouts, SPAs avoid persistent cookies due to CSRF risk, CLI tools cache credentials locally for 1 to 12 hours (as with AWS SSO), and mobile apps use separate biometric flows, all forcing repeated re-authentication. _Developers wrestling with fragmented SSO flows can follow identity and access management coverage on daily.dev._ ### How long do AWS SSO cached credentials remain valid before I need to log in again? AWS SSO credentials cached locally in ~/.aws/sso/cache remain valid for between 1 hour and 12 hours, depending on configuration. Once they expire, the CLI or SDK prompts for re-authentication through the SSO flow again, which is why frequent AWS CLI users often notice repeated login prompts throughout the day. _Anyone tuning AWS session duration settings can track access-control practices on daily.dev._ ### What is a proposed long-term fix for the poor SSO user experience across apps? Using certificate authorities and client certificates is proposed as a way to encode both identity and session duration directly into a certificate, removing the need for cookies or repeated redirect-based logins. A client certificate could then be presented to applications for access, though current PKI infrastructure tooling and client-side UX are still considered poor. _Teams weighing certificate-based auth against traditional SSO can follow the debate on daily.dev._ ## Similar posts on daily.dev - [The Ultimate Guide to Single Sign-On in 2025](https://daily.dev/posts/the-ultimate-guide-to-single-sign-on-in-2025-pxybfj6ei) · Security Boulevard · 0 upvotes · 0 comments - [Is Your SSO Protected Against Modern Credential Attacks?](https://daily.dev/posts/is-your-sso-protected-against-modern-credential-attacks--yuhxr3r0k) · BleepingComputer · 0 upvotes · 0 comments - [The Future of Single Sign-on: Insights for 2025](https://daily.dev/posts/the-future-of-single-sign-on-insights-for-2025-stlazrbut) · Security Boulevard · 0 upvotes · 0 comments - [SAML: A fractal of bad design](https://daily.dev/posts/saml-a-fractal-of-bad-design-6cl53ggxw) · Lobsters · 1 upvotes · 0 comments --- Tags: [#authentication](https://daily.dev/tags/authentication), [#okta](https://daily.dev/tags/okta) [View this post on daily.dev](https://daily.dev/posts/why-sso-sucks-and-the-future-of-sso-njpp1vcp7) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Why SSO Sucks and the future of SSO","url":"https://daily.dev/posts/why-sso-sucks-and-the-future-of-sso-njpp1vcp7","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/why-sso-sucks-and-the-future-of-sso-njpp1vcp7"},"datePublished":"2026-08-23T12:21:43.993Z","dateModified":"2026-08-23T12:40:00.062Z","description":"An exploration of why single sign-on (SSO) fails to deliver a truly 'single' login experience across web apps, SPAs, CLI tools, and mobile apps, driven by...","image":"https://media.daily.dev/image/upload/s--0_ODbtD2--/f_auto/v1722860399/public/Placeholder%2008","thumbnailUrl":"https://media.daily.dev/image/upload/s--0_ODbtD2--/f_auto/v1722860399/public/Placeholder%2008","isAccessibleForFree":true,"articleSection":"Teleport","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Teleport","logo":"https://media.daily.dev/image/upload/s--Dw-Bbw6O--/c_limit,w_256/f_auto,q_auto/v1787487494/logos/teleport?_a=BAMAMicg0","url":"https://daily.dev/sources/teleport"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/why-sso-sucks-and-the-future-of-sso-njpp1vcp7","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"authentication,okta","timeRequired":"PT10M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Teleport","item":"https://daily.dev/sources/teleport"},{"@type":"ListItem","position":3,"name":"Why SSO Sucks and the future of SSO"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/why-sso-sucks-and-the-future-of-sso-njpp1vcp7#faq","mainEntity":[{"@type":"Question","name":"Why do I have to log in with SSO multiple times a day even though it's supposed to be 'single' sign-on?","acceptedAnswer":{"@type":"Answer","text":"Each application controls its own login process and has a different architecture, so there is no standardized flow that works across all apps. Web apps use server or client-side sessions with timeouts, SPAs avoid persistent cookies due to CSRF risk, CLI tools cache credentials locally for 1 to 12 hours (as with AWS SSO), and mobile apps use separate biometric flows, all forcing repeated re-authentication. Developers wrestling with fragmented SSO flows can follow identity and access management coverage on daily.dev."}},{"@type":"Question","name":"How long do AWS SSO cached credentials remain valid before I need to log in again?","acceptedAnswer":{"@type":"Answer","text":"AWS SSO credentials cached locally in ~/.aws/sso/cache remain valid for between 1 hour and 12 hours, depending on configuration. Once they expire, the CLI or SDK prompts for re-authentication through the SSO flow again, which is why frequent AWS CLI users often notice repeated login prompts throughout the day. Anyone tuning AWS session duration settings can track access-control practices on daily.dev."}},{"@type":"Question","name":"What is a proposed long-term fix for the poor SSO user experience across apps?","acceptedAnswer":{"@type":"Answer","text":"Using certificate authorities and client certificates is proposed as a way to encode both identity and session duration directly into a certificate, removing the need for cookies or repeated redirect-based logins. A client certificate could then be presented to applications for access, though current PKI infrastructure tooling and client-side UX are still considered poor. Teams weighing certificate-based auth against traditional SSO can follow the debate on daily.dev."}}]} ```