Sessions and tokens

🏠The everyday picture

After the guard checks your ID, you get a visitor badge for the day. Anyone holding the badge looks like you, so badges must be hard to copy, expire at the end of the day, and be taken back when you leave.

📘What it really is

After login, the server gives the browser proof of the login:
session cookies (Module 44): a random ID stored on the server; easy to revoke;
tokens such as JWTs (JSON Web Tokens): signed data the server can check without a database lookup; hard to revoke before they expire.
Cookie settings for session cookies: HttpOnly (JavaScript can't read it, limiting XSS damage), Secure (HTTPS only), SameSite=Lax or Strict (helps against CSRF, Module 75), a sensible Max-Age.
Session safety:
a new session ID at login (stops session fixation);
expiry: idle timeout (for example, 30 minutes for admins) and an absolute limit;
logout really deletes the session on the server;
revoke all sessions when a password changes or an account is disabled.
JWT pitfalls:
always verify the signature and the algorithm; reject alg: none;
keep them short-lived (minutes) with refresh tokens that can be revoked;
don't put secrets or personal data in them (they're only encoded, not encrypted);
don't store them in localStorage where any XSS can read them; prefer HttpOnly cookies.
For a browser app talking to its own API on the same domain (Module 66), server-side sessions in cookies are usually the simplest safe choice.

🖱️Try it

In your browser's developer tools (Application → Cookies), inspect your CRM's session cookie and confirm HttpOnly, Secure and SameSite. Log in, copy the cookie value, log out, and try the old value with curl against an authenticated endpoint: it must be rejected. Change your password and check that other sessions are logged out.

✅Quick check

Why should session cookies be HttpOnly?

Show the answer

So JavaScript (including injected scripts) can't read and steal them.

Why are JWTs hard to revoke?

Show the answer

The server accepts any validly signed token until it expires, without checking a list; so they must be short-lived.