Web Session
A web session keeps related actions connected across separate web requests for a limited time. It often links a hard-to-guess ID to state stored on the server.
Another example
A signed-in support agent has a session ID, last-use time, and a 30-minute idle limit. Sign-in changes the ID, every request checks it, and 30 minutes of no use ends it. One browser tab is not always one session, and a cookie is only one way to carry the ID.
Main parts
- 01opaque identifier
- 02associated state
- 03lifetime policy
Use it when
Use this term for signed-in continuity, server state, ID rotation, expiry, or ending access across requests.
Do not use it when
Do not use session as a loose name for one page view or browser process. It is also not an access token or analytics visit.
Name used in code
session ID ↔ server state + expiry Before you ship
Check contracts and invariants, authorization, and input limits. Test retries, one-time effects, timeouts, and partial failures. Verify data integrity, compatibility, monitoring, recovery, and rollback.
Outcome: Design or review Web Session for this system while keeping data correct, secure, and easy to operate. User context: A signed-in support agent has a session ID, last-use time, and a 30-minute idle limit. Sign-in changes the ID, every request checks it, and 30 minutes of no use ends it. One browser tab is not always one session, and a cookie is only one way to carry the ID. Technical concept or control: Web Session. Why it fits: Use this term for signed-in continuity, server state, ID rotation, expiry, or ending access across requests. Do not use it when: Do not use session as a loose name for one page view or browser process. It is also not an access token or analytics visit. Engineering requirements: Define inputs, outputs, contracts, and rules that must always hold. Set authorization and input checks. Define failures, timeouts, retries, one-time effects, data moves, and compatibility limits. Operations: Add useful signals and logs that hide sensitive data. Set capacity limits and write an operator guide. Test recovery and rollback. Acceptance criteria: Contract and failure-path tests pass. Data and authorization rules still hold during retries and partial failures. Check performance limits, monitoring, recovery, and rollback. Evidence and limits (evidence boundary): It is official for that source. Other platforms or teams may use the term in another way. Unknowns to confirm: Where the code runs, data stores, traffic shape, consistency needs, and the security boundary. Also confirm the compatibility period, service goals, and rollback limits.
Check this request
Review the current use of Web Session. Definition: A web session keeps related actions connected across separate web requests for a limited time. It often links a hard-to-guess ID to state stored on the server. Release checks: Check contracts and invariants, authorization, and input limits. Test retries, one-time effects, timeouts, and partial failures. Verify data integrity, compatibility, monitoring, recovery, and rollback. Before changing code, report the evidence you found, gaps, severity, and the smallest safe fix.