Session security

A session is what keeps a user signed in after they authenticate. Session security is about two things: how long a session may live, and how fast you can end one.

Lifetime and behavior controls

Under Security → Sessions you tune the session policy for the instance:

• Token lifetime (jwtTtlSeconds) — how long a single session JWT is valid before it must be refreshed. Short lifetimes mean a stolen token expires quickly; it's also the bound within which a revocation or permission change takes effect.

• Absolute lifetime (absoluteMs) — the hard cap after which a session ends regardless of activity and the user must sign in again.

• Inactivity / idle timeout — sign out sessions that have been idle too long.

• Token strategy — refresh (a long-lived refresh mechanism mints short JWTs) or sliding (the window extends with activity).

• Refresh rotation — rotate the refresh token on every use, with reuse detection: replaying an old token invalidates the whole session, which catches token theft.

• Multi-session / single-session — allow a user to be signed in on several devices at once, optionally capped by max concurrent sessions, or run single-session mode where a new sign-in ends older ones.

• Revoke on password change — end every existing session when a user changes their password.

• Cross-subdomain cookies — share the session across subdomains of your app when you need to.

Revoking sessions

Ending a session is immediate and available at several granularities:

• One device — revoke a single session from the user's record (per-device sign-out).

• Everywhere — sign a user out of every device; Atlas bumps the user's sessions_version so all existing tokens stop verifying at their next check.

• On ban — banning a user from Users revokes every session they hold.

• Global — for an incident, revoke broadly and force everyone to sign in again.

Because verification is bound by the token lifetime, a revocation takes full effect within one jwtTtlSeconds window — a good reason to keep that lifetime short.

Recommended starting point

• Short token lifetime, refresh rotation on, reuse detection catching theft.

• A sensible absolute lifetime and an idle timeout.

• Revoke on password change on.

• Single-session mode for high-security apps; multi-session with a device cap for consumer apps.

Next

Keep a record of everything that happens → Audit logs.