Rotate, revoke, and step up sessions

A session has a lifecycle. It should not remain equally trusted forever after one login.

Rotate identifiers after authentication and privilege changes, set idle and absolute expiry, revoke on logout and password reset, and let users end other sessions. Require recent authentication or MFA for sensitive actions such as email, password, or recovery changes.

Idle and absolute expiry solve different problems. Idle expiry closes abandoned sessions after inactivity. Absolute expiry limits the lifetime even when the session stays active.

Track lifecycle fields on the server:

created_at
last_seen_at
authenticated_at
expires_at
revoked_at

Update last_seen_at at a controlled interval rather than writing on every request. Use authenticated_at to decide whether the proof is fresh enough for a sensitive action.

Rotation should be atomic: create the new identifier, invalidate the old one, then send the new cookie. Test concurrent requests during rotation so an old request cannot restore the previous credential.

“Logout all devices” revokes every session for the account, including the current one unless the product says otherwise. Password reset should normally do the same or present that choice clearly.

Step-up authentication is action-specific. Reading a book may use the existing session, while changing recovery details requires a fresh password, passkey, or MFA proof.

Add logout-current and logout-all endpoints plus a recent-auth requirement for changing the account email. Verify old identifiers fail after each transition.