Skip to main content

Explore
/
Authentication
/
Session management: Security protocol

Session management: Security protocol

Server-side session records rotate identifiers on privilege change, revoke an entire session family on logout or compromise, and expose list-and-revoke evidence in the account UX without storing secrets in cookies.

Referencev0.1.0NOASSERTION

Published Sep 12, 2026

Overview Files Versions Dependencies Related

Security

Refresh tokens: Security protocol

Refresh tokens rotate on every use, reuse of a spent token revokes the entire token family, and access tokens issued after detection are invalid, following RFC 6749 grant rules and OAuth 2.0 Security BCP reuse guidance.

Reference · v0.1.0 · NOASSERTION

Ux

Multi-factor authentication: Behavior and lifecycle

Short-lived MFA challenges bind to a pending session, step-up gates sensitive actions, recovery codes are single-use, and a password replay cannot skip an in-progress or required second factor.

Reference · v0.1.0 · NOASSERTION

Security

Password recovery: Security protocol

Password reset uses hashed single-use tokens, identical responses for unknown accounts, session-family revocation on success, and throttles keyed by account hash plus network range to resist enumeration and flooding.

Reference · v0.1.0 · NOASSERTION