https://blog.hardcodeconsulting.tech/tags/session-management/ Recent content in Session-Management on Hardcode Consulting https://blog.hardcodeconsulting.tech/favicon.svg https://blog.hardcodeconsulting.tech/favicon.svg Hugo -- 0.167.0 en Sun, 26 Jul 2026 18:00:00 +0530 https://blog.hardcodeconsulting.tech/post/session-branching-instead-of-narrowing/ Sun, 26 Jul 2026 18:00:00 +0530 https://blog.hardcodeconsulting.tech/post/session-branching-instead-of-narrowing/ A refresh that cannot prove its device should not touch the session it was presented against. Insert a new row, and let the real client collapse the rest. https://blog.hardcodeconsulting.tech/post/refresh-token-reuse-detection-tradeoff/ Sun, 12 Jul 2026 18:00:00 +0530 https://blog.hardcodeconsulting.tech/post/refresh-token-reuse-detection-tradeoff/ Removing refresh token reuse detection looked like a small trade. It quietly lets a thief and the real user converge on one live pair, permanently. https://blog.hardcodeconsulting.tech/post/scope-tiers-half-authenticated-session/ Sun, 05 Jul 2026 18:00:00 +0530 https://blog.hardcodeconsulting.tech/post/scope-tiers-half-authenticated-session/ Signing in is not a boolean. A scope tier on the session row says how far a half finished session may go, and why the lowest tier is not the middle one. https://blog.hardcodeconsulting.tech/post/refresh-token-rotation-previous-pair/ Sun, 28 Jun 2026 18:00:00 +0530 https://blog.hardcodeconsulting.tech/post/refresh-token-rotation-previous-pair/ Single use refresh tokens log people out when a response is lost. Keeping a previous pair on the session row fixes it without reopening unlimited minting. https://blog.hardcodeconsulting.tech/post/jwt-was-never-stateless/ Sun, 21 Jun 2026 18:00:00 +0530 https://blog.hardcodeconsulting.tech/post/jwt-was-never-stateless/ Every JWT system that must block a user ends up reading a database per request. Designing refresh token rotation around that, not against it.