39 lines
2.3 KiB
Markdown
39 lines
2.3 KiB
Markdown
# Session And Device Management
|
|
|
|
Authenticated users can inspect their active browser sessions under **Settings
|
|
> Sessions and devices**. Each row exposes only a stable session identifier,
|
|
current-session marker, bounded user-agent label, creation time, last activity,
|
|
expiry, and lifecycle state. Session tokens, token and CSRF hashes, cookies, IP
|
|
addresses, and unrelated request metadata are never returned.
|
|
|
|
Users may revoke one other session or all other active sessions. The current
|
|
session is deliberately protected by these operations; use normal logout to end
|
|
it. Repeating a revocation is safe. Revoked sessions fail authentication on the
|
|
next request, including when a principal summary was previously cached.
|
|
|
|
The shared WebUI clears reusable API response data on explicit authentication,
|
|
account, tenant, and permission transitions, changed session/CSRF cookies, and
|
|
authentication-expiry responses. Late reads cannot repopulate caches after those
|
|
transitions or after a write finishes. `no-store` responses are not retained;
|
|
`no-cache` responses require server revalidation, with ETags retained only where
|
|
storage is allowed. Reload bypasses older cached responses. These safeguards do
|
|
not erase content already displayed by a page: reload that page to reflect
|
|
remote changes. The server remains authoritative for every permission check.
|
|
|
|
Successful interactive sign-in, including re-login, and local sign-out clear
|
|
the saved automation API key. It must not shadow the newly established cookie
|
|
session with a different principal. Explicitly applying an API key in connection
|
|
settings still selects that credential's identity and triggers a new shell
|
|
authentication check. Ordinary profile updates in API-key mode retain the key.
|
|
|
|
Tenant administrators may list sessions only for a membership in their governed
|
|
tenant and may revoke only a session belonging to that membership and tenant.
|
|
The mutation requires both the central membership-update permission and an
|
|
interactive-session password re-authorization. API-key administration and
|
|
cross-tenant session disclosure fail closed.
|
|
|
|
Audit events retain the actor, target session or account, action, and revoked
|
|
count where applicable. They do not copy client labels, network addresses, or
|
|
credentials. Expired and revoked sessions are retained according to Access data
|
|
retention and are omitted from the active-session list.
|