Add session mgt guide

[wbamberg]

Here's a page on session management.

Terminology

I've talked mostly about two different models, one where the state is stored in the server and the client gets a session ID, and the other where the state is stored as a signed object (JWT) in the client. I've called these "centralized" and "decentralized" but people don't use these terms.

People sometimes use terms like "cookie-based" for the first and the second "JWT-based", but I don't like these, because ISTM that:

1. how you store session information in the client and communicate it to the server is orthogonal to these architectural choices - that is, you don't have to do the first using cookies, and you could do the second using cookies

2. (this is a much weaker objection) although in practice everyone does use JWTs for the second, that's an implementation choice not an architectural one.

I have asked about this and got feedback that my choice here is reasonable, but just flagging it here. We could call them "server-maintained state" and "client-maintained state" which is more descriptive but a real mouthful.

Frameworks and libraries

Regarding the section on "Frameworks and libraries", I do think we need to say this but went back and forth on whether to say it at the start or at the end, and how much detail to go into. FWIW although it might seem to negate the point of all this if we just tell people to use a framework, I really don't think it does - it is important to understand the principles and good practices, even if your framework is looking after a lot of the details for you.

[github-actions]

[mdn-linter] _{reported by reviewdog 🐶}

Suggested change

	1. When the client attempts some high-risk operation, such as attempting to change, or actually changing, the user's credentials on the site, or triggering the account recovery (e.g. password reset) process.
	1. When the client attempts some high-risk operation, such as attempting to change, or actually changing, the user's credentials on the site, or triggering the account recovery (e.g., password reset) process.

[github-actions]

Preview URLs (1 page)

• /en-US/docs/Web/Security/Authentication/Session_management

External URLs (3)

URL: /en-US/docs/Web/Security/Authentication/Session_management
Title: Session management

• https://auth0.com/blog/critical-vulnerabilities-in-json-web-token-libraries/ (1 time) (Note! This may be a new URL 👀)
• https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html (3 times) (Note! This may be a new URL 👀)
• https://www.jwt.io/ (1 time) (Note! This may be a new URL 👀)

(comment last updated: 2026-01-28 04:17:59)