Skip to main content

Session Management

Overview​

LoginRadius offers a comprehensive set of tools for effectively managing customer login sessions. These features enable businesses to enhance user experiences by providing secure and seamless platform access. This includes capabilities for creating sessions, tracking user logins, managing session expiration, and refreshing sessions.

Common Use Cases & Key Features​

  • Enhanced Security: Protect user accounts and sensitive data by setting session expiration policies, reducing the risk of unauthorized access and session hijacking.
  • Improved User Experience: Features like sliding sessions and "Remember Me" will improve customer convenience by allowing them to remain logged in longer.
  • Access Control & Compliance: The “Restrict Login Sharing” feature ensures compliance with organizational security policies by preventing unauthorized session sharing and enforcing access control at the user and application levels.
  • Automated Security Measures: Enhance fraud prevention and account security with “Force Logout,” which automatically terminates active sessions when a user resets or changes their password, preventing unauthorized access from previous sessions.

What is a Session?​

A session refers to the duration a user interacts with an application after authenticating. It allows the application to recognize the user and maintain their state across multiple requests. Sessions are managed using tokens, such as the LoginRadius Access Token, and storage mechanisms to ensure secure and seamless user experiences.

Access Token​

The LoginRadius Access Token is a secure token issued after a user successfully logs in or authenticates. It is key to granting the user access to specific resources and performing authorized actions within the application.

Key Features of Access Tokens:​

  • Authorization:
    • Enables secure access to protected resources.
    • Eliminates the need for the application to handle user credentials directly.
  • Short-Lived Tokens:
    • Typically valid for a specific duration to minimize security risks
  • Seamless Session Continuity
    • Automatically renewing access tokens offers a smooth, uninterrupted experience, reducing users' need to log in frequently.

Managing Active SSO Sessions with LoginRadius​

An active Single Sign-On (SSO) session enables seamless authentication using a valid LoginRadius Access Token. This token allows secure access to resources and user sessions. After a successful login, a session cookie is set on the Hosted Page Domain.

[tenant].hub.loginradius.com.

If an SSO session is not found, the user is redirected to the logout process or presented with the login interface to re-authenticate.

For a detailed explanation of handling SSO sessions, refer to the SSO Overview.

Configuration​

Follow the steps below to set up various session management options in the admin console.

  1. Log in to the LoginRadius Console.
  2. Navigate to Security > Session Management.

Access tokens are short-lived unique identifiers given to each user after successful authentication. They allow secure access to user profiles and enable operations on them.

Important Notes on Access Token

  1. Token Expiry: The lifetime of an access token can be set from 1 to 129,600 minutes (90 days). For a longer expiry, contact LoginRadius support.
  2. Default Lifetime: By default, the access token expires after 15 minutes
  3. Refresh Token Adjustment: When the access token lifetime is updated, the refresh token lifetime automatically adjusts to 1.5 times the access token lifetime.
  4. Post-Expiry: Once expired, the access token can no longer perform any actions.

Automated Workflows​

LoginRadius automated workflows enhance session management, prioritize security, and improve user convenience. These workflows provide robust tools for managing sessions dynamically, protecting against unauthorized access, and ensuring seamless user experiences.

  • Sliding Sessions: If a refresh token is used before expiration, its validity may extend based on specific configurations.
  • Force Logout: Automatically terminates all active sessions when users reset or change their password, enhancing security.
  • Brute Force Lockout: Prevents repeated failed login attempts to trigger the brute force attacks.[Ref Link]
  • Remember Me: Provides secure and extended user sessions, enhancing convenience by reducing the need for frequent logins while maintaining high security.

Integration Guide​

This section offers a detailed walkthrough and recommendations for integrating session management into your back-end or front-end via Rest APIs or SDKs.

The following details help generate the session token by using the Login APIs or directly generating the session token as an administrator.

Use Login by Email API to create the session token during login using the email/password.

Use Account Impersonation API to generate the access/refresh directly without login **(backend only).

Note: Some APIs require an API secret as a parameter. Due to security considerations, using the API Secret on the client side is not recommended. We suggest using a wrapper to make the API call from the client side. This method will ensure adherence to security practices and prevent potential compromises of your API secret.

Best Practices​

  • Secure Refresh Tokens: Always store Refresh Tokens in a safe location to minimize the risk of a token leakage.
  • Set Appropriate Expiry Times: Configure Access and Refresh Token lifetimes based on the application's security needs.