Session Management
Idle and absolute timeouts, concurrency caps, refresh-token rotation with reuse detection, and per-session or global revocation. Sessions rotate on privilege changes and are revoked on credential changes.
Idle timeout
30 minutes (sliding)
Absolute lifetime
12 hours (hard cap)
Max concurrent
5 per user (oldest evicted)
Step-up validity
15 minutes
Refresh rotation
On every use; reuse revokes the family
Cookies
HttpOnly · Secure · SameSite=Lax
Find a user (blank = your own sessions)
Load a user's sessions to view and manage them.