Server-Side Sessions

Nothing stops them. A cookie value is input the caller can retype, so a plain-text role claim is simply edited. The value must be an unguessable reference to a record the scheduler holds, or state the server can prove it wrote.

The idle clock restarts on every request and ends a session left unattended. The absolute clock counts from the sign-in that created the record, never restarts, and caps how long one authentication may keep counting.

A short-lived, single-purpose pre-authentication handle bound to one login attempt and to the factor still pending, carrying no authority to reach application endpoints. It must be its own credential, not a signed-in session record wearing a pending flag.

Pinning raises the cost of using a stolen session reference — the thief must also call from that network — but never prevents it. The price is paid by legitimate callers whose address moves: roaming clients, carrier re-addressing and shared egress pools.

Every state-changing endpoint an automatically-attached session cookie can reach needs an anti-forgery check or a written reason it does not. Run it at one choke point in front of the handlers, so protection is the default and exemptions are named.

Derive it from four measured quantities: live sessions, the guess rate your front door permits, the window identifiers stay valid, and the hit probability you accept. Expected hits are about N x R x T / 2^B, which puts the floor near 64 bits and the norm at 128.

Keep a monotonic version on the user record and a copy in every session record. Bumping it invalidates the whole set in one write, and the per-request check becomes a comparison. The counter cannot spare a row, so re-issue the current device after the bump.

Destroying the record is one item on a list. A persistent-login cookie, the anti-forgery token, credentials obtained downstream, connections authenticated at handshake and already-rendered pages all outlive it. The forgotten one is whatever can create a new session unaided.

A session-tier fault invalidates a whole signed-in population at once rather than degrading one request. Bound the radius in advance: keep irreplaceable records off the regenerable tier, and choose the degraded mode before the incident.

The User-Agent string is chosen and sent by the client, and it changes on its own — an automatic update rewrites it mid-session. Binding a server-side session record to it logs out honest users while a thief simply replays the string.

Four fields do the work: device label, last-seen time, approximate location, and which row is the current session. Only the last is a client fact the server establishes itself; the label is asserted by the client, the location inferred from an address.

A server re-issues the session identifier at authentication and at every privilege change: a second factor accepted, a role elevated, an acting-as session entered or left. What breaks is state that was keyed to the identifier just replaced.

Abandonment ends the attempt when the handle's short absolute clock passes, and the visitor restarts from the password step. Requesting the factor again keeps the same handle and the same deadline. Success consumes it: destroy the handle, then issue a fresh session.

Neither is discarded automatically: surface both and let the camper choose, keeping both holds until they do. Idempotency comes from marking the guest record migrated before destroying it, so a retried sign-in finds nothing left to copy.

Three families: use from two places that cannot both be true at once, an established client property changing mid-session, and a request rate or ordering no human produces. The verdict routes to record-only, challenge, or end — never straight to end.

A receiver endpoint authenticated by a signature over the request body needs no anti-forgery check because no user agent attaches that credential by itself, so a hostile page cannot make an authenticated request arrive. Scope the exemption to that path.

Signing stops alteration but not reading, so it suffices only when the contents are safe for the holder to see. Encrypt — with authenticated encryption, never bare ciphertext — when the roster or the roles are themselves worth hiding. Both replay until they expire.

Overlap in a strict order: every instance must accept the new key for verification before any instance signs with it, and the retiring key stays in the verification set for at least the longest remaining lifetime of anything it signed.

Price both sides before choosing. On a fixed shared terminal the address and agent never vary, so a binding yields no true positives and only correlated false positives when a fleet update lands. The defensible answer there is to bind nothing and detect instead.

Read it wherever the request already loads the user, and the kill is immediate. Cache it and the kill lags by the cache lifetime, so pick that lag against the threat behind the button, write through on the revoke path, and publish the number.

Recovery from a session-tier fault is a synchronised step, not a retry curve: a whole population hits the most expensive path in the system at once. Size the credential path against that number, admit traffic deliberately, and rehearse it.