# What is Session Management?

> Session management controls what happens after login — how session tokens are issued, bound, refreshed, expired, and revoked so an authenticated session stays tied to its legitimate user.

- Canonical URL: https://yellowcube.eu/glossary/session-management/
- Publisher: Yellow Cube
- Language: en
- Contact: hello@yellowcube.eu

## Content

Once authentication succeeds, the session — usually a cookie, token, or assertion — becomes the proof of identity for subsequent requests. Management covers token generation and storage, idle and absolute timeouts, re-authentication triggers, device binding, sign-out, and revocation when risk changes or credentials are suspected of compromise.

### Key points

- **Session as credential:** A stolen or replayed token inherits the login; protect tokens in transit and storage, and make revocation actually work.
- **Risk-aligned lifetimes:** Short idle timeouts, re-authentication for sensitive actions, and shorter lifetimes for privileged or external sessions.
- **Important limitation:** Strong authentication does not secure a long-lived session. Token theft, fixation, and cross-site scripting can bypass even phishing-resistant login if session handling is weak.

### Related terms

[Authentication token](<https://yellowcube.eu/glossary/authentication-token/>) · [Authentication](<https://yellowcube.eu/glossary/authentication/>) · [Conditional access](<https://yellowcube.eu/glossary/conditional-access/>) · [Web application security](<https://yellowcube.eu/glossary/web-application-security/>) · [Account recovery](<https://yellowcube.eu/glossary/account-recovery/>) · [Session hijacking](<https://yellowcube.eu/glossary/session-hijacking/>)

### Sources

[OWASP, Session Management Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html) · [NIST SP 800-63B-4, Digital Identity Guidelines: Authentication and Authenticator Management](https://csrc.nist.gov/pubs/sp/800/63/b/4/final)

## Attribution and scope

This Markdown representation is generated from the same approved content records as the canonical HTML page. Cite the canonical URL above when referencing this material. Product and service descriptions are informational; confirm project-specific requirements with Yellow Cube.