HTML MASTER CLASS /// LEARN TAGS /// BUILD STRUCTURE /// SEMANTIC WEB /// HTML MASTER CLASS /// LEARN TAGS ///

Untitled Lesson

⚡ Total XP: 0|💻 backend XP: 0

Skill Matrix

UNLOCK NODES BY LEARNING NEW TAGS.

Select an unlocked node to view details root

Pascual Vila

Full-Stack Software and AI Engineer

Full-Stack Software and AI Engineer with 6 years of experience building enterprise-grade web applications across React, Angular, Node.js, and Python. Recently completed a Master's in AI Development specializing in LLMs, RAG, and AI agent architectures, and currently builds enterprise systems that integrate AI and Digital Twins to optimize industrial and logistics processes.

LinkedIn ↗

Common Pitfalls & Errors

The Error //

Changing a user's password without invalidating their other active sessions

// Wrong: attacker's existing session remains valid after the change
await updatePasswordHash(userId, newPassword);

// Correct: every OTHER session is invalidated
await updatePasswordHash(userId, newPassword);
await revokeAllSessionsExcept(userId, currentSessionId);

The Solution //

If an attacker gained access via a stolen password and the legitimate user changes their password to resecure their account, any session the attacker had already established remains valid unless explicitly invalidated — the attacker retains access despite the password change, defeating its security purpose.

The Error //

Implementing only an idle timeout with no absolute maximum session timeout

// Insufficient alone: no upper bound on total session length
if (idleTime > IDLE_TIMEOUT) invalidate(session);

// Correct: both protections, addressing different risk scenarios
if (idleTime > IDLE_TIMEOUT) invalidate(session);
if (totalSessionAge > ABSOLUTE_TIMEOUT) invalidate(session);

The Solution //

An idle timeout alone allows a session to be extended indefinitely as long as some activity occurs periodically, with no upper bound on the total session length — an absolute timeout provides an important additional safeguard by bounding the maximum session duration regardless of ongoing activity.