Sessions

Studio issues a server-backed session after completed authentication. Each account can have at most five active sessions across its browsers and devices.

Limits and Expiry

Policy	Behavior
Concurrent sessions	A new session retains the four most recently active existing sessions; older activity is revoked first
Idle timeout	12 hours without accepted session activity
Absolute lifetime	7 days from session creation, regardless of activity
Activity persistence	Activity updates are throttled to five-minute intervals

The activity order uses the stored last-seen time, with creation time and ID as tie-breakers. A sixth login does not fail solely because the limit was reached; it removes an older session to make room.

An open browser tab alone does not guarantee a session stays active. The Worker validates expiry and the account’s current authentication revision when resolving the session. A stored cookie is not proof that access remains valid.

Session Storage and Request Protection

The browser receives an HttpOnly, same-site session cookie. Production HTTPS uses secure cookie handling. Studio stores a digest of the session secret in D1 and checks it when resolving the cookie. Browser scripts cannot read the HttpOnly cookie.

Authenticated mutations also require the expected origin and CSRF proof. Role and ownership checks still apply after session verification. The browser’s navigation visibility is not the authorization boundary.

Review and Revoke

The account’s session list shows the current session and available connection information, including IP, User-Agent, country, and network data. Revoke an individual session or the other sessions when ending access on another device.

Account role, status, password, and MFA changes can invalidate existing sessions through an authentication revision change. Flows that preserve the current session still end other sessions as specified by the action. Explicit sign-out revokes the current session.

When a session expires during editing, Studio asks for authentication while keeping the workspace mounted. Signing back into the same account can retain that workspace. This does not replace saving content or guarantee recovery after a page reload.

Cloudflare Access has its own session and expiry behavior. Passing that outer gate does not renew a Studio session. Major sign-in and revocation events are covered by Audit Log.