Sessions and sign-out

How the website remembers sign-in and ends access on a device.

Session cookie

The browser receives a fragment_session cookie with an opaque random identifier. Its HttpOnly attribute keeps it inaccessible to client-side JavaScript. In production, the cookie is sent only over HTTPS.

Session lifetime

A session lasts 7 days. Sign in through the bot again when it expires. A new sign-in confirmation replaces the current session in that browser.

Sign out

POST /api/auth/logout removes the session from server storage, so a copy of the old cookie no longer grants access. Sign-out applies to the current browser.