Session management: Security protocol

Server-side session records rotate identifiers on privilege change, revoke an entire session family on logout or compromise, and expose list-and-revoke evidence in the account UX without storing secrets in cookies.

Published Sep 12, 2026