Session Management

Kind: mechanism

Layer: Security Core

Record: architecture:session-management

Severity: contextual

Scope: service, authentication, security

Canonical: Ontology

A mechanism that keeps authenticated sessions on the server, with expiry, rotation and revocation, and gives the client only an opaque identifier.

Listed in Architecture principles, after Parameterized Queries and before Ports and Adapters Architecture.

Requires

• Authentication

Reinforces

• Access Control
• Least Privilege

Enables

• Bounded Session Lifetime
• Revocable Access

Conflicts with

• Immortal Client-Trusted Session

In tension with

• User Convenience

Tensions

• Session Management / User Convenience

Violated by

• Immortal Client-Trusted Session

Severity

• contextual

Category

• Security / Privacy / Compliance / Governance

Refactors

• Statelessness

Linked from

• Scalability / Performance / Optimization
• Security / Privacy / Compliance / Governance
• Security Privacy Compliance
• Severity levels
• The resolutions