Session Management for GraphQL Platform | Cosmo by WunderGraph - WunderGraph
Sessions that stay secure without interrupting work
Industry-standard session policies: 8-hour renewal while active, 72-hour inactivity timeout, 14-day maximum lifetime. High-risk operations require email confirmation.
Follows standards set by Auth0, Cloudflare, and similar authorities.
The problem
Sessions without limits create exposure
Balancing security and usability in session management is hard. Sessions that never expire create risk. Sessions that expire too often frustrate users. Neither extreme is acceptable.
Sessions that never expire are a security risk
Indefinite sessions mean a compromised credential grants permanent access. There is no forcing function for users to reauthenticate, even after extended periods.
Abandoned sessions stay active
When engineers leave for vacation or switch machines without logging out, their sessions remain open. Anyone who accesses the browser inherits their access.
Sensitive operations need extra confirmation
A single authenticated session protecting destructive actions — like organization deletion — creates risk from accidental clicks and unauthorized access with valid credentials.
Our solution
Calibrated policies that balance security and usability
Cosmo session policies follow standards set by industry leaders. Active users are never interrupted. Inactive sessions close automatically. Destructive operations require an extra confirmation step.
How sessions work
- Sessions are created when a user authenticates via password, Google, GitHub, or SSO.
- During active use, sessions renew every 8 hours automatically.
- If a session has no activity for 72 hours, it terminates automatically.
- Regardless of activity, sessions expire after a maximum of 14 days from creation.
- After the maximum lifetime, the user must reauthenticate to continue.
- High-risk operations — such as organization deletion — require email confirmation as an additional step.
Session Management
Before & After
| Before Cosmo | With Cosmo |
|---|---|
| No session expiration policy | 14-day maximum session lifetime, enforced automatically |
| Abandoned sessions stay active indefinitely | 72-hour inactivity timeout terminates sessions automatically |
| Constant reauthentication during active work | 8-hour session renewal while the user is active |
| Destructive operations protected only by session | High-risk operations require email confirmation |
Multiple authentication options
- Email and password: Standard credential authentication
- Google: Social login via Google OAuth
- GitHub: Social login via GitHub OAuth
- SSO: OIDC identity provider (Enterprise)
How Cosmo Session Management works
Active renewal
While a user is active in Cosmo Studio, their session renews every 8 hours. Continuous work proceeds without interruption.
Inactivity timeout
When a session has no activity for 72 hours, it terminates automatically. The user must log in again to continue. Abandoned sessions don't persist.
Maximum lifetime
All sessions have a maximum lifetime of 14 days from creation, regardless of activity. After 14 days, reauthentication is required.
High-risk confirmation
Sensitive operations like organization deletion require email confirmation before they proceed. This prevents accidental or unauthorized destructive actions.
What's included
Secure sessions on every plan
- 8-hour active renewal: Sessions renew every 8 hours during active use.
- 72-hour inactivity timeout: Inactive sessions terminate automatically after 72 hours.
- 14-day maximum lifetime: All sessions expire after 14 days from creation.
- Email confirmation for high-risk operations: Destructive operations require email confirmation before they proceed.
Start building with secure sessions
Session management is included on every Cosmo plan, with no configuration required.
FAQ
Session Management on Cosmo
- How long does a Cosmo session last?
- Which plan is Session Management available on?
- What triggers the 72-hour inactivity timeout?
- Which login methods are supported?
- Which operations require email confirmation?
- Can session policies be customized?
Full details in the sessions documentation.