Session management handles user session lifecycle from creation to termination, including session tokens (JWT or opaque), timeout policies, concurrent session limits, and secure session revocation. Balances security (short sessions) with usability (remember me, SSO).
Status: specification