Session Security

Session Security configures and monitors concurrent session protection and idle timeout policies for admin accounts. These controls prevent account sharing and session hijacking, compliant with ISO 27001 A.9.4.2 and A.11.2.8.

'alt' => 'Dashboard overview', 'caption' => 'The default Kiwire dashboard layout', 'screenshot' => true, 'class' => '', ]) Drop images into: public/assets/img/docs/{page}/{filename} --}}

Image not uploaded yet public/assets/img/docs/session-security/overview.png

Concurrent Session Protection

By default, Kiwire enforces a one active session per admin account policy. When an admin logs in from a new device or browser, any existing session for that account is immediately terminated.

How it works: Kiwire tracks the active session for each admin account server-side. When a login occurs from a new device, the previous session's binding is updated. On every subsequent request the session is validated against the stored binding — if the session no longer matches, the request is rejected and the admin is force-logged out with a message: "Your session was terminated because the account logged in from another device."

This prevents an attacker who has obtained a session token (e.g., via a stolen cookie) from maintaining access once the legitimate admin logs in again.

Idle Timeout

Admin sessions are automatically invalidated after a configurable period of inactivity. The last-activity timestamp is tracked on every request. If more than N minutes have passed since the last activity, the session is destroyed and the admin is redirected to login.

This prevents unattended browser sessions from remaining active indefinitely on shared or public computers.

Active Sessions View

The active sessions grid shows currently authenticated admin sessions across the tenant:

Column	Description
Admin	Name and email of the admin.
IP Address	Source IP of the session.
User Agent	Browser and operating system string.
Last Activity	Timestamp of the most recent request in this session.
Session Age	How long the session has been active since login.

Force Logout

• Force logout all my other sessions — available to any admin from their own profile. Terminates all other active sessions for their account immediately.
• Force logout any admin — available to superusers from the active sessions grid. Select any row and click Force Logout.

Security Alerts

When a concurrent session is detected and the old session is terminated, a security notification is generated. If the admin whose session was terminated considers the new login suspicious, they should immediately change their password and report the incident.

Configuration Settings

Setting	Default	Description
Idle Timeout	30 min	Minutes of inactivity before a session is invalidated. Can also be set via SESSION_IDLE_TIMEOUT env variable; the UI value takes precedence.
Maximum Session Age	8 hours	Absolute maximum session lifetime, regardless of activity. After this duration, the admin must re-authenticate even if they have been continuously active.
Allow Concurrent Sessions	Off	When enabled, multiple simultaneous sessions per admin account are permitted. When off (recommended), the single-session policy is enforced.
Allow Remember Me	On	Whether the "Remember me" checkbox is shown on the login page. When off, admins must log in on every browser session regardless of previous sessions.

Required Permissions

view-session-security · update-session-security