Core | Session Security

[john20xdoe]

Using Single Token:Device:Point-in-time:Account concept
Attempted with nacc_0 and leuzin project.

Description:
An account (a user, a bot) can only execute an operation (login, create a session) under the authority of a unique random token, preferably a namespaced GUID, generated with time constraints (expiry, duration), and activated only from one point-of-entry (email link, SMS link, device sensors).

The toke namespace is unique to the account's context but should be irreversible/irreusable. One way is to add time prefixes (when was it generated).

Pros:

Cons: