---
description: Studio's five-session limit, idle and absolute expiry, session revocation, and reauthentication behavior.
---

# Sessions

Studio issues a server-backed session after completed authentication. Each
account can have **at most five active sessions** across its browsers and
devices.

## Limits and Expiry

| Policy | Behavior |
| --- | --- |
| Concurrent sessions | A new session retains the four most recently active existing sessions; older activity is revoked first |
| Idle timeout | 12 hours without accepted session activity |
| Absolute lifetime | 7 days from session creation, regardless of activity |
| Activity persistence | Activity updates are throttled to five-minute intervals |

The activity order uses the stored last-seen time, with creation time and ID
as tie-breakers. A sixth login does not fail solely because the limit was
reached; it removes an older session to make room.

An open browser tab alone does not guarantee a session stays active. The
Worker validates expiry and the account's current authentication revision
when resolving the session. A stored cookie is not proof that access remains
valid.

## Session Storage and Request Protection

The browser receives an HttpOnly, same-site session cookie. Production HTTPS
uses secure cookie handling. Studio stores a digest of the session secret in
D1 and checks it when resolving the cookie. Browser scripts cannot read the
HttpOnly cookie.

Authenticated mutations also require the expected origin and CSRF proof.
Role and ownership checks still apply after session verification. The browser's
navigation visibility is not the authorization boundary.

## Review and Revoke

The account's session list shows the current session and available connection
information, including IP, User-Agent, country, and network data. Revoke an
individual session or the other sessions when ending access on another device.

Account role, status, password, and MFA changes can invalidate existing sessions
through an authentication revision change. Flows that preserve the current
session still end other sessions as specified by the action. Explicit sign-out
revokes the current session.

When a session expires during editing, Studio asks for authentication while
keeping the workspace mounted. Signing back into the same account can retain
that workspace. This does not replace saving content or guarantee recovery
after a page reload.

[Cloudflare Access](../cloudflare-access/index.md) has its own session and
expiry behavior. Passing that outer gate does not renew a Studio session.
Major sign-in and revocation events are covered by
[Audit Log](../audit-log/index.md).