Database session security beyond cookie flags

Own Auth returns an opaque session token to the application and stores only its peppered hash. Protected requests resolve that token against current server-side state, so expiry, revocation, and account disabling take effect without waiting for a signed client credential to expire.

Keep the raw token out of storage

A database reader cannot copy Own Auth's stored hash directly into a request. The raw value exists while the application sets the client credential and presents it for verification. It must not enter logs, analytics, traces, URLs, or error reports. NIST SP 800-63B-4 also requires session secrets to be random, time-limited, protected in transit, unavailable to intermediaries, and invalidated at sign-out.

Keep the browser cookie narrow

For a browser application, send the token in a cookie with Secure, HttpOnly, and an appropriate SameSite policy. Limit its domain and path to the smallest practical scope. A __Host- prefix with Path=/, no Domain attribute, and HTTPS provides a strong default when the application architecture supports it. Set the cookie expiry at or before the server-side session deadline.

HttpOnly blocks direct JavaScript reads but does not stop a script from issuing requests through the browser. SameSite narrows common cross-site request forgery paths but does not replace the application's CSRF checks. Native clients need platform-protected credential storage, with tokens excluded from deep links and diagnostic data.

Verify current server-side state on every request

Resolve the token to the current session and user before application authorization. Verification rejects an unknown hash, revoked record, absolute expiry, idle expiry, and disabled account. Authorization then uses current user and membership data. A valid session does not establish current organisation membership, an administrative role, or permission for the requested resource.

Own Auth's auth.getCurrentSession returns null when a session is unknown, expired, revoked, or attached to a disabled user. A successful verification updates lastActiveAt and extends the idle deadline without extending the absolute deadline. After a failed check, clear the client cookie instead of repeatedly presenting a rejected credential.

Enforce both absolute and idle limits

The idle deadline advances with verified activity, while the absolute deadline caps the session even when it remains active. The server-side values are authoritative; cookie expiry only removes the client copy. Extending the cookie beyond either database deadline does not extend access.

Require fresh authentication for sensitive transitions such as changing recovery details, accessing high-value exports, or performing destructive organisation actions. A session can prove continuity, but it does not prove that the original user is still present. NIST treats reauthentication as a distinct control and sets tighter requirements as authentication assurance increases.

Make revocation immediate and visible

Own Auth supports auth.signOut, individual auth.revokeSession, and auth.revokeAllSessions. Password reset and account disabling revoke every session automatically. Session records retain creation, activity, expiry, request metadata, and revocation state. Active-device screens can display that metadata, but user agents and IP addresses are hints rather than authenticated device identities.

Keep verification revocable

Database sessions add a lookup to protected requests, so the token verifier needs an index and bounded database latency. A verification cache also delays expiry, revocation, and account-disable changes unless it has a short lifetime and an explicit invalidation path. That delay is part of the session security behavior, not only a performance setting.

Lifecycle coverage should cross the idle and absolute deadlines, revoke one session, revoke all sessions, disable the account, and verify that the next request fails in each case. It should also confirm that successful checks update activity without moving the absolute deadline and that raw session tokens never appear in telemetry.