session-management
Articles tagged with session-management.
Keycloak 26.8.1 SAML Logout Fix: One Client Could End Another's Sessions
Keycloak 26.8.1 changes how SAML single logout treats a SessionIndex owned by another client. What the code did before, what…
6 min readWhat Is Session Fixation? How It Differs From Session Hijacking
Session fixation plants a known session ID before the victim logs in. How it differs from session hijacking, where it…
6 min readSession Hijacking: Why MFA Doesn't Save a Stolen Session
Session hijacking uses a stolen cookie or token, so MFA never fires. How infostealers do it, what limits the damage,…
8 min read
Session Management: Cookies vs Tokens vs Server-Side
Cookies vs tokens vs server-side sessions for distributed systems: security trade-offs, 2026 cookie changes, and how Keycloak persists sessions by…
11 min readKeycloak Session Timeout Best Practices: Idle, Max, Refresh
Recommended Keycloak session timeout values: SSO Session Idle, SSO Session Max, client sessions and refresh token rotation, with console paths…
21 min readKeycloak Token Expired: Understanding and Fixing Token Issues
Fix Keycloak token expiration issues by understanding access token lifespans, refresh token rotation, and session timeout configuration with practical examples.
9 min read
Session Management in Keycloak: From Refresh to Idle Timeouts
How Keycloak session management works: access, refresh and ID tokens, the SSO idle and session-max timeouts, token lifespans, and security…
7 min readStay ahead on identity & security
Get tutorials, product updates, and Keycloak tips delivered to your inbox.