Sessions

Abstract

A user’s interaction with an application over a period of time is known as a session. Upon authenticating to an application, a user expects to navigate through the application and perform various transactions during their session without having to authenticate every time they do something. In order to make this possible, an application needs a way to track that a user has been authenticated. Data about whether, when, and how a user has authenticated may be tracked by an application along with other information it maintains during a user’s session. Sessions and session state may be handled differently for web applications, single-page applications, and applications that run natively on a device, such as mobile application s. In this chapter, we’ll describe where sessions exist, session expiration, and renewing sessions.