2.3 KiB
Session And Device Management
Authenticated users can inspect their active browser sessions under **Settings
Sessions and devices**. Each row exposes only a stable session identifier, current-session marker, bounded user-agent label, creation time, last activity, expiry, and lifecycle state. Session tokens, token and CSRF hashes, cookies, IP addresses, and unrelated request metadata are never returned.
Users may revoke one other session or all other active sessions. The current session is deliberately protected by these operations; use normal logout to end it. Repeating a revocation is safe. Revoked sessions fail authentication on the next request, including when a principal summary was previously cached.
The shared WebUI clears reusable API response data on explicit authentication,
account, tenant, and permission transitions, changed session/CSRF cookies, and
authentication-expiry responses. Late reads cannot repopulate caches after those
transitions or after a write finishes. no-store responses are not retained;
no-cache responses require server revalidation, with ETags retained only where
storage is allowed. Reload bypasses older cached responses. These safeguards do
not erase content already displayed by a page: reload that page to reflect
remote changes. The server remains authoritative for every permission check.
Successful interactive sign-in, including re-login, and local sign-out clear the saved automation API key. It must not shadow the newly established cookie session with a different principal. Explicitly applying an API key in connection settings still selects that credential's identity and triggers a new shell authentication check. Ordinary profile updates in API-key mode retain the key.
Tenant administrators may list sessions only for a membership in their governed tenant and may revoke only a session belonging to that membership and tenant. The mutation requires both the central membership-update permission and an interactive-session password re-authorization. API-key administration and cross-tenant session disclosure fail closed.
Audit events retain the actor, target session or account, action, and revoked count where applicable. They do not copy client labels, network addresses, or credentials. Expired and revoked sessions are retained according to Access data retention and are omitted from the active-session list.