Software Design

User Session and Auth Token States

State Diagrams · made in Skemio

State diagram depicting user session states: Initial to Guest, Guest to Authenticated on login, Authenticated to Expired on TTL, Expired to Authenticated on refresh, and to Revoked on logout.

Open it in Skemio Make your own

What it shows

Guest sessions elevate to Authenticated via verified credentials.
Expired tokens trigger silent refresh rotation without user friction.
Revocation immediately invalidates both access and refresh tokens.

The takeaway

Separating expiration from revocation prevents session hijacking and token replay attacks.

#Security
#OAuth
#JWT
#Backend
#WebDev
#Coding

More state diagrams