Session Management

Session management is one of two crucial steps of implementing digital identity (the other being Authentication). It is the process by which the server maintains the state of the user's authentication so that they may continue to use the system without re-authenticating.

Session Binding

Upon successful authentication, a session is created and binded to the client. A session identifier (session ID) name-value pair is randomly generated and assigned.

Generally, we use cookies to store session IDs due to the possibilities of advanced token properties such as expiration and usage constraints.

Sources

• https://owasp.org/www-project-proactive-controls/v3/en/c6-digital-identity
• https://pages.nist.gov/800-63-3/sp800-63b.html#sec7
• https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html