# Session Management

> A mechanism that keeps authenticated sessions on the server, with expiry, rotation and revocation, and gives the client only an opaque identifier.

Record: `architecture:session-management`
Kind: mechanism
Layer: [Security Core](https://banes-lab.com/records/layer/security-core.md)
Severity: contextual
Scope: service, authentication, security
Canonical: https://banes-lab.com/ontology#architecture-session-management

Listed in [Architecture principles](https://banes-lab.com/api/records/architecture.md), after [Parameterized Queries](https://banes-lab.com/records/architecture/parameterized-queries.md) and before [Ports and Adapters Architecture](https://banes-lab.com/records/architecture/ports-and-adapters-architecture.md).

## Repair

- Refactored by: Introduce Server-Side Session Management
- Detected by: no expiry/rotation/revocation on sessions
- Violated by: client-supplied identity trusted without server-side session
- Measured by: unbounded-session count
- Enforced by: security review

## Requires

- [Authentication](https://banes-lab.com/records/architecture/authentication.md)

## Reinforces

- [Access Control](https://banes-lab.com/records/architecture/access-control.md)
- [Least Privilege](https://banes-lab.com/records/architecture/least-privilege.md)

## Enables

- [Bounded Session Lifetime](https://banes-lab.com/records/lexicon/bounded-session-lifetime.md)
- [Revocable Access](https://banes-lab.com/records/lexicon/revocable-access.md)

## Conflicts with

- [Immortal Client-Trusted Session](https://banes-lab.com/records/lexicon/immortal-client-trusted-session.md)

## In tension with

- [User Convenience](https://banes-lab.com/records/lexicon/user-convenience.md)

## Tensions

- [Session Management / User Convenience](https://banes-lab.com/records/tension/session-management-user-convenience.md)

## Severity

- [contextual](https://banes-lab.com/records/vocabulary/severity-contextual.md)

## Category

- [Security / Privacy / Compliance / Governance](https://banes-lab.com/records/architecture-category/security-privacy-compliance-governance.md)

## Linked from

- [Security / Privacy / Compliance / Governance](https://banes-lab.com/ontology/principles/architecture-category-security-privacy-compliance-governance.md)
- [Security Privacy Compliance](https://banes-lab.com/ontology/lexicon/lexicon-category-security-privacy-compliance.md)
- [Severity levels](https://banes-lab.com/ontology/schema/the-vocabulary-severity.md)
- [The resolutions](https://banes-lab.com/ontology/schema/the-resolutions.md)