Managing sessions

Session management has a direct impact on some key aspects such as user experience, security, and performance.

From a user experience perspective, Keycloak relies on sessions to determine whether users and clients are authenticated, for how long they should be authenticated, and when it is time to re-authenticate them. This characteristic of sessions is basically what gives users the single sign-on experience when authenticating to different clients within the same realm, and what makes a unified authentication experience possible.

From a security perspective, sessions provide a security layer for tracking and controlling user activity and for making sure that tokens issued to clients are still valid passports to act on behalf of users. They are also important to limit and control the time users can stay connected to a realm and its clients, helping to reduce the attack surface when sessions or tokens are leaked or stolen. As we are going to see later in this...