24 lines
1.3 KiB
Markdown
24 lines
1.3 KiB
Markdown
# Session And Device Management
|
|
|
|
Authenticated users can inspect their active browser sessions under **Settings
|
|
> Sessions and devices**. Each row exposes only a stable session identifier,
|
|
current-session marker, bounded user-agent label, creation time, last activity,
|
|
expiry, and lifecycle state. Session tokens, token and CSRF hashes, cookies, IP
|
|
addresses, and unrelated request metadata are never returned.
|
|
|
|
Users may revoke one other session or all other active sessions. The current
|
|
session is deliberately protected by these operations; use normal logout to end
|
|
it. Repeating a revocation is safe. Revoked sessions fail authentication on the
|
|
next request, including when a principal summary was previously cached.
|
|
|
|
Tenant administrators may list sessions only for a membership in their governed
|
|
tenant and may revoke only a session belonging to that membership and tenant.
|
|
The mutation requires both the central membership-update permission and an
|
|
interactive-session password re-authorization. API-key administration and
|
|
cross-tenant session disclosure fail closed.
|
|
|
|
Audit events retain the actor, target session or account, action, and revoked
|
|
count where applicable. They do not copy client labels, network addresses, or
|
|
credentials. Expired and revoked sessions are retained according to Access data
|
|
retention and are omitted from the active-session list.
|