What it means
A session lets a service connect a sequence of requests to shared state. After authentication, a session commonly lets the user continue without presenting their authenticator on every request. A browser may hold a session identifier in a cookie while the server stores the associated state, though implementations vary. The identifier must be treated as sensitive access material.
Session management covers creation, renewal, expiration, and invalidation. Authentication answers how the session was established; authorization still determines what each request can do. A stolen active session can sometimes be used without repeating the original sign-in, so strong authentication does not remove the need for session protection.
AN ILLUSTRATIVE SCENARIO
A council staff laptop
A council employee reports a lost laptop that may still have an active session in a case-management application. The response team disables the affected access as appropriate and separately revokes application sessions using the service's supported mechanism. It does not assume that changing the password or closing a browser elsewhere immediately ends every session. With a test account, the administrator verifies that the old session can no longer retrieve a synthetic case record.
Put it to work
- Use the framework's maintained session facilities; protect browser cookies with suitable Secure, HttpOnly, and SameSite settings for the application's behavior.
- Define inactivity and overall lifetimes based on risk, renew session identifiers after authentication or privilege changes, and provide server-side invalidation.
- Test logout, expiry, account disablement, and incident-driven revocation across the relevant applications; avoid putting live session values in URLs or logs.
How to check your work
Save a test session, revoke it through the intended mechanism, and try a protected request again. The service should reject it according to the documented policy, with useful evidence that avoids exposing the session secret.
Connect the ideas
- Authentication
The act of verifying a claimed identity with authenticators such as passwords, passkeys, or certificates.
- Authorization
The decision about whether a person, device, workload, or anonymous requester may perform a particular action on a resource.
- SSO
A pattern where one authentication to an identity provider is reused across multiple applications.
- Account recovery
The process that restores access when authenticators are lost, which can become the weakest authenticator.