Once authentication succeeds, the session — usually a cookie, token, or assertion — becomes the proof of identity for subsequent requests. Management covers token generation and storage, idle and absolute timeouts, re-authentication triggers, device binding, sign-out, and revocation when risk changes or credentials are suspected of compromise.
Key points
Session as credentialA stolen or replayed token inherits the login; protect tokens in transit and storage, and make revocation actually work.
Risk-aligned lifetimesShort idle timeouts, re-authentication for sensitive actions, and shorter lifetimes for privileged or external sessions.
Important limitationStrong authentication does not secure a long-lived session. Token theft, fixation, and cross-site scripting can bypass even phishing-resistant login if session handling is weak.