Overview
Understanding Account Security
This page explains how to protect your private pages and manage user sessions securely within the application. Protecting private pages ensures that only verified individuals can view sensitive areas of your site, while session management keeps track of who is logged in so they do not have to sign in on every click.
Note
Authentication confirms who the user is, whereas authorization determines what pages and actions that user is allowed to access.
Protecting Private Pages
1. Identify Pages to Protect
Make a list of URLs or sections in your application that contain sensitive information—such as account settings, admin dashboards, or personal data—that should never be visible to the public.
2. Apply Security Rules
Configure your page settings to require login credentials before granting entry.
Tip
Always test your protection rules by opening your protected pages in an anonymous or "Incognito" browser window to verify that unauthenticated visitors are properly blocked.
3. Handle Unauthorized Access
Decide what happens when an unauthenticated visitor tries to open a private page. Standard behavior automatically redirects them to the login screen, often preserving the page they originally wanted to visit so they can return to it after signing in.
Managing User Sessions
Session Lifespan and Security
A user session begins the moment someone successfully signs in with their credentials, and it ends when they log out or their session expires. Sessions allow users to navigate between different private pages without repeatedly entering their password. However, for security reasons, sessions do not last forever.
Warning
Leaving a session active indefinitely on a shared or public computer poses a major security risk. Always log out when you finish your session.
Common Session Settings
| Setting Option | Description | Recommended Practice |
|---|---|---|
| Session Timeout | How long a user can remain inactive before they are automatically logged out. | Set to 15–30 minutes for highly sensitive applications. |
| Remember Me | Extends the session lifespan so the user stays logged in across browser restarts. | Use only on private, trusted personal devices. |
| Single Session | Prevents a user account from being logged into multiple devices simultaneously. | Enable if strict account sharing prevention is required. |