Session Management

EduShade tracks every active login session with detailed device and location information. You can view, monitor, and terminate sessions from your account settings.

What is a Session?

A session is created every time you log in from a device or browser. Each session tracks:

Device Information

Location Information (via IP Geolocation)

Viewing Active Sessions

For Users (Self-Service)

1. Go to Account Settings → Devices (or /dashboard/profile/settings/devices)
2. View a list of all your active sessions
3. The current session is highlighted/labeled so you can identify it

Each session card shows:

• Device type icon (desktop/mobile/tablet)
• Browser and OS
• Location (city, country)
• Login time
• Last activity

For Admins (User Management)

1. Go to Admin → User Management
2. Open a user's profile
3. Navigate to the Sessions tab
4. View all active sessions for that user

Terminating Sessions

Terminate a Specific Session

1. Find the session you want to terminate
2. Click the Terminate or Revoke button
3. Confirm the action
4. The session is immediately invalidated
5. The user on that device/browser will be logged out on their next request

Terminate All Other Sessions

1. On the sessions page, click Terminate All Other Sessions
2. Confirm the action
3. All sessions except your current one are invalidated
4. Useful if you suspect unauthorized access

Admin Session Termination

Admins can terminate sessions for any user:

1. Go to Admin → User Management → [User] → Sessions
2. Terminate individual sessions or all sessions
3. Requires user.update permission

Session Expiry

Sessions have a configurable expiration time:

• Access Token: Short-lived (configured per deployment)
• Refresh Token: Long-lived, stored in the session record
• When the refresh token expires, the session becomes inactive
• Expired sessions are automatically marked as inactive

Logout

Logging out invalidates your current session:

1. Click Logout from the user menu
2. Your current session's refresh token is invalidated
3. Access and refresh tokens are cleared from your browser
4. You are redirected to the login page

Security Best Practices

• Regularly review your active sessions to spot unfamiliar devices or locations
• Terminate unknown sessions immediately if you see a device or location you don't recognize
• Terminate all sessions after changing your password
• Log out when using shared or public computers
• Enable email verification to prevent unauthorized account access

Troubleshooting