Sessietokens

Sessietokens (session tokens) are unique identifiers that allow a server to recognize a client’s session across multiple requests without re-authentication. They are issued after successful authentication and are sent with each request to authorize access to resources.

They can be stored and transmitted in different ways. In traditional web applications, a session token is kept in a cookie, typically with the HttpOnly and Secure attributes and, ideally, a SameSite policy to mitigate CSRF. The server stores session data and maps it to the token. In API-driven or microservice architectures, tokens may be self-contained, such as JSON Web Tokens (JWTs), which carry claims and can be validated without a central session store; or they may remain opaque and reference a server-side session.

Lifecycle: a token is created on login, then presented by the client with each request. Tokens have an expiration time; some systems also issue a refresh token to obtain a new access token without reauthenticating. Tokens can be rotated to reduce risk and can be revoked on logout or when a breach is suspected.

Security considerations: protecting the token is critical. Use encryption in transit (TLS); prefer HttpOnly and Secure cookies and proper SameSite settings; avoid storing tokens in easily accessible locations such as localStorage where possible; implement short lifetimes and token rotation; monitor for anomalies and provide revocation mechanisms.

See also: authentication, cookies, JSON Web Token, OAuth, refresh tokens, session management.