Tag
session-management
- Sep 21, 2026 Sharding Session Data and the Size Ceiling How session keys are partitioned across nodes as the store grows, why resharding is safer at a partition layer, and what a large cookie costs on every request. backend systems
- Jul 10, 2026 Concurrent Mutations and Versioned Session Records Why whole-record writes lose updates when a browser issues requests in parallel, and how compare-and-set, fencing tokens, and delta operations keep the record coherent. backend systems
- Jan 28, 2026 Read-Your-Writes Across Replicated Session Stores Which consistency guarantees a session actually needs, why a replica read can undo a rotation, and how version tokens and home-region ownership keep a user from seeing their own past. backend systems
- Oct 16, 2025 Reading a BGP Session Failure From Its State and Its Last Error How the session states narrow a failure to transport, capability negotiation, or policy, and why a session that reaches Established can still exchange no routes. networking
- Sep 12, 2025 Key Design and Eviction in External Session Stores How session records are keyed, sized, and expired in Redis and Memcached, and why an eviction policy can turn a memory shortage into a login outage. backend systems
- Jun 24, 2025 Cookie Scope, Attributes, and Transport Rules The exact matching rules that decide whether a browser attaches a session cookie to a request, and how Domain, Path, Secure, HttpOnly, and SameSite narrow that decision. backend systems
- Nov 23, 2024 How a Session Identifier Binds Requests to Server State What the opaque string in a session cookie actually denotes, how much entropy it needs, and why the identifier and the record it points at have separate lifetimes. backend systems
- Nov 19, 2024 Load Balancer Session Affinity and Its Failure Modes How sticky routing is implemented at layer 4 and layer 7, why consistent hashing limits the damage of a node loss, and which failures affinity cannot prevent. backend systems
- May 23, 2024 Session Fixation, Rotation, and Revocation Why authenticating in place hands an attacker a valid session, how rotation must be sequenced to survive concurrent requests, and what revocation can and cannot reach. backend systems
- May 2, 2024 Federated Session State: Logout, Propagation, and the Limits of Single Sign-Out Why a logout at one relying party cannot reliably end sessions at others, how back-channel and front-channel logout differ, and what session identifiers can and cannot carry. internet protocols
- Feb 8, 2024 Session Fixation and Why Identifiers Must Rotate How an attacker who chooses a session identifier inherits the victim's authenticated session, and which state transitions require a fresh identifier to break the link. security
- Jan 23, 2022 How Cookie Attributes Bound a Session Credential What the Domain, Path, Secure, HttpOnly, and SameSite attributes actually constrain, which of them are enforced by the browser versus the server, and where the scope model leaks. security