S
Oct 25, 2026Stop counting down: the right way to warn users before their session expires
The other day I was answering a question about a countdown timer that kept drifting wrong whenever...
Oct 25, 20266 min read0 reactions0 comments
Back to articles
Tag archive
#session
R
Oct 24, 2026Rejetto HFS signs its admin session cookie with Math.random()
CVE-2026-61500 in Rejetto HFS derives the session signing key from Math.random(), exposes generator output during login, and lets an attacker mint an administrator cookie that reaches server_code execution.
Oct 24, 20265 min read0 reactions0 comments
S
Oct 18, 2026Screen Sharing Session API: Per-Participant Publish Permissions for Node.js Workspaces
Short answer: Use a server-issued, short-lived display capability per participant, renew presence...
Oct 18, 20264 min read0 reactions0 comments
C
Sep 22, 2026Concrete Node.js Session Mechanics and Revocation Trade-offs for Fintech Sign-In
TL;DR: A session is the server-approved continuity between one successful sign-in and later requests....
Sep 22, 20267 min read0 reactions0 comments
S
Sep 19, 2026Session Verify Returns Invalid After Deploy: 3 Cookie Checks Explained
Short answer: when session verification starts returning invalid after a deploy, first prove that the...
Sep 19, 20266 min read0 reactions0 comments
S
Sep 24, 2026Session Middleware: Verify Every Request with a Short Cache
Keep the session ID in an httpOnly cookie, verify that ID in middleware on every protected request,...
Sep 24, 20267 min read0 reactions0 comments
P
Oct 8, 2026Python Session Revocation — What Actually Matters in Concrete Forgot-Password Audits
TL;DR: For a forgot-password flow that must survive audit, keep a server-side session record, revoke...
Oct 8, 20267 min read1 reactions0 comments
W
Sep 22, 2026What a Session Actually Is and Why Revocation Matters (Gaming Signup)
Short answer: A session is what the server actually records when a login happens, and revocation...
Sep 22, 20268 min read0 reactions0 comments
A
Sep 19, 2026A 2-Rule Guide to Revoke One User Session or All Sessions
Use single-session revocation for routine device logout, and reserve revoke-all for evidence of...
Sep 19, 20267 min read0 reactions0 comments
H
Sep 11, 2026Healthtech Session Lifecycle: Create, Verify, Refresh, Revoke, and Revoke All Safely
Account recovery is where a session lifecycle is explained by its consequences: create and verify...
Sep 11, 20267 min read0 reactions0 comments
G
Sep 10, 2026Global Logout Auditing Explained (A Property Management Session Revocation Guide)
Short answer: treat global logout as an auditable state transition, not a single button. Take a...
Sep 10, 20266 min read0 reactions0 comments
R
Sep 10, 2026Revoked Session Verification: Diagnosing Logout When Access Remains Active
Short answer: verify logout as a sequence, not a button click. Record the session ID, revoke that...
Sep 10, 20266 min read0 reactions0 comments