Skip to main content

Session Management

Summary​

Identity creates a device-session record at login, associates refresh tokens with that session, updates activity during refresh, and supports current-device or all-device logout.

Audience​

  • Platform and customer administrators
  • Implementation and support teams
  • Developers and QA engineers
  • Solution architects and security engineers

Purpose​

Session management provides server-side visibility and revocation control for a user’s authenticated devices and refresh-token activity.

Architecture​

Business concepts​

  • A device session belongs to one identity user.
  • A session records a display name and operational request metadata.
  • One or more refresh-token records can be associated with a session through rotation.
  • An active session has no revocation time.
  • Logout can revoke one session or all sessions for the user.
  • User-visible security events provide a recent history of selected authentication activity.

Technical implementation​

Login persists a hashed session key, device name, remember-me choice, creation time, and last-seen time. The current-user session endpoint returns the user’s sessions ordered by recent activity and indicates whether each record is active.

Refresh rejects a token when its associated device session has been revoked. Single-device logout revokes the presented refresh token and linked session. All-device logout revokes every active refresh token and device session for the authenticated user.

Confirmed security events cover successful or rejected login activity, account lock activity, device-session creation, token refresh, logout, all-device logout, email verification, and changes to two-factor configuration. Detailed event payloads and operational retention are outside this public page.

Confirmed source references​

  • microservices/src/identity-service/Application/Auth/IdentityAuthService.cs
  • microservices/src/identity-service/Domain/Entities/DeviceSession.cs
  • microservices/src/identity-service/Domain/Entities/RefreshToken.cs
  • microservices/src/identity-service/Domain/Entities/SecurityEvent.cs
  • microservices/src/identity-service/Domain/Entities/LoginAudit.cs
  • microservices/src/identity-service/Program.cs

See Also​

Keywords​

  • Multi-device logout
  • Session activity
  • Security event

Revision Information​

  • Last reviewed: 2026-07-14
  • Owner: identity-team
  • Status: Draft