# Sessions

A session is one signed-in browser: a stored row plus a cookie that browser holds. It lasts about a fortnight by default, it belongs to that browser alone, and four things end it — expiry, signing out, being revoked from the security screen, or a different person signing in on the same browser. Nothing you do on one device disturbs another.

- **Status:** Available
- **Audience:** both
- **In the app:** #/account
- **Last verified:** 2026-09-10
- **Canonical:** https://connectbyjbrh.com/docs/account/sessions/

## What a session is

Two halves. A row in Connect records that this session exists, when it started, when it was last used and whether it has been revoked. A cookie in your browser carries the token that points at it. The token is stored as a hash rather than in readable form, so the copy Connect holds cannot be used to impersonate you even by somebody reading the table.

The cookie is marked so that page scripts cannot read it, restricted to requests coming from Connect's own pages, and sent only over HTTPS in production. Those three flags are why a session is a browser fact rather than something you can copy out and paste elsewhere.

Sessions are deliberately kept outside every workspace's data. They are platform records, alongside identity and billing, which is what lets one person hold sessions for different workspaces without the two touching.

## How long one lasts

| Event | Effect on this browser | Effect on your other devices |
|---|---|---|
| Nothing — normal use | Roughly two weeks from sign-in; the deployment can be configured to a shorter or longer life within fixed bounds | None |
| Signing out | The session is revoked and the cookie is cleared immediately | None |
| 'Sign out of other devices' | Nothing; the session you are using is deliberately never the one revoked | Every other session for you ends at once |
| Somebody else signs in here | Your session on this browser is ended | None — that sign-in is not their business |
| Expiry | The next request is refused and you are returned to sign-in | None |
| An administrator deactivating the user | The next request fails to resolve an identity | The same, everywhere |

> **Note** Expiry is silent. There is no warning before it, and the first sign of it is a screen that asks you to sign in again. If a page looks empty rather than signed out, reload it before assuming a data problem — an expired session and an empty workspace can look similar for a moment.

## Seeing your own sessions

The account screen lists every session you currently have. Each row shows a short identifier, a device description derived from the browser's own user-agent string, how you signed in, when the session started and when it was last used — and marks which row is the one you are reading it from.

Revoked and expired sessions are not listed. The list is what is live now, not a history, which makes 'is there anything here I do not recognise' a question you can answer in a glance rather than by reading dates.

- The device description is a guess made from a string your browser sends. It is good enough to recognise your own laptop; it is not evidence of anything.
- The identifier is short on purpose. It is enough to tell two rows apart and useless to anybody who reads it over your shoulder.
- Last-seen time is the honest way to spot a session you have forgotten: a device you have not used in a month is the one to end.

## What a session is not

**Not an account** — One person can hold several sessions at once, on different devices. Ending one says nothing about the others.
**Not a workspace** — The session resolves *to* a workspace on every request. It does not carry the workspace's data around, and it cannot be pointed at a different one.
**Not a permission** — What you may do inside a workspace comes from your role there, not from having signed in. A valid session with no membership resolves to nothing at all.
**Not transferable** — A session is bound to the browser that holds the cookie. There is no way to move one to another device, and no reason to want to: signing in again is a session.

## Questions

### How do I end a session on a device I no longer have?

Use 'sign out of other devices' from the security screen. It ends every session except the one you are using, which covers a lost phone or a shared computer without needing the device itself. See [security settings](/docs/account/security-settings/).

### Why was I signed out without warning?

Most likely the session simply reached its age. Sessions are not extended indefinitely by activity, and there is no notice before one expires. The other possibilities are somebody using 'sign out of other devices', or a different person signing in on that same browser.

### Does closing the browser end my session?

No. The cookie survives a browser restart until it expires or is revoked, which is why the deliberate controls matter on a shared machine. Signing out is the reliable way to leave nothing behind.

## Related

- [Account and access](https://connectbyjbrh.com/docs/account/)
- [Signing in with Google](https://connectbyjbrh.com/docs/account/google-sign-in/)
- [Signing in as somebody else](https://connectbyjbrh.com/docs/account/session-replacement/)
- [Security settings](https://connectbyjbrh.com/docs/account/security-settings/)
- [Establishing a session, end to end](https://connectbyjbrh.com/docs/workflows/session-establishment/)
- [You were signed out](https://connectbyjbrh.com/docs/troubleshooting/session-expired/)
- [Public and authenticated surfaces](https://connectbyjbrh.com/docs/security/public-vs-private/)

## What this page is based on

- Connect source pack §10 — sessions and the security posture (`docs-source/sources/GENERAL.md`)
- `backend/app/main.py` — the session cookie's flags and default lifetime, and the account payload
- `backend/app/app_auth.py` — session rows, revocation and the purge of expired ones