Managing sessions

Session management has a direct impact on some key aspects such as user experience, security, high availability, and performance.

From a user experience perspective, Keycloak relies on sessions to determine whether users and clients are authenticated, for how long they should be authenticated, and when it is time to re-authenticate them. This characteristic of sessions is basically what gives users the single sign-on (SSO) experience when authenticating to different clients within the same realm, and what makes a unified authentication experience possible.

From a security perspective, sessions provide a security layer for tracking and controlling user activity and making sure that tokens issued to clients are still valid passports to act on behalf of users. They are also important for limiting and controlling the amount of time for which users can stay connected to a realm and its clients, helping to reduce the attack surface when sessions or tokens are leaked...