Hi, Alberto.
I wonder if oxAuth handles the session and cookies on its own, or just delegates this task to underlying web server (Jetty). Still, unless @Yuriy.Zabrovarnyy or @Yuriy.Movchan, or @Thomas Gasmyr.Mougang will have a free minute to share a hint, I think it's a bit beyond Community Support's scope. Source codes are available for studying on Github, so you'll have to do some research there. For example oxAuth code is [here](https://github.com/GluuFederation/oxAuth).