sessionstokens

Sessionstokens are identifiers issued by a server to represent an authenticated user session. They enable a client to access multiple resources without re-authenticating on every request. Sessionstokens can be opaque, with the server storing session data and using the token as a key, or self-contained, such as JSON Web Tokens, which encode claims and can be validated cryptographically without a server lookup.

In typical deployments, a token is stored on the client and sent with each request, commonly via an HttpOnly, Secure cookie or in an Authorization header. On login, the server creates a session record and returns a token that references it; for stateless variants, the token itself carries session information. Each request validates the token; if valid, the server associates the request with the corresponding session. Logout or expiry invalidates the token or its server-side session.

Lifetimes for sessionstokens vary. Server-side sessions usually have a defined expiration and may be revoked centrally. Self-contained tokens carry an expiry claim and often employ refresh tokens to obtain new tokens without re-authenticating. Security best practices include using TLS, setting HttpOnly and Secure flags, applying SameSite to mitigate CSRF, rotating tokens on login, and implementing revocation mechanisms for compromised tokens.

Compared to purely server-stored sessions, stateless tokens reduce server load but require careful handling to support revocation and timely expiry. Sessionstokens are widely used in web applications, APIs, and mobile clients, and are related to cookies, OAuth2 tokens, and single sign-on configurations.