Foundation · 2 min
What you need to know
What is a login session?
A login session is the temporary authenticated state that lets a user continue without proving identity on every request. A protected session identifier links requests to that state.
How long should ecommerce login sessions last?
Session length should reflect account risk, device context and customer needs, with both inactivity and overall limits. Offer device management and reauthentication for sensitive changes.
Should admin sessions expire faster than customer sessions?
Yes. Admin sessions expose broader powers and should usually have shorter inactivity and overall limits plus reauthentication for sensitive actions.
Should users be logged out after password changes?
Revoke existing sessions after a password change caused by compromise or recovery and let users review or end other sessions. Explain the effect before a voluntary change when appropriate.
How should suspicious login attempts be handled?
Rate-limit attempts, compare risk signals, require stronger verification and alert on meaningful anomalies without revealing sensitive details. Avoid permanent lockouts that attackers can trigger against victims.
What is account takeover?
Account takeover occurs when an attacker gains control of a legitimate customer or administrator account. Stolen passwords, sessions, email access, and manipulated recovery are common routes.
How can ecommerce stores reduce account takeover risk?
Use MFA, breached-password blocking, rate limits, suspicious-login detection, secure sessions, protected recovery and customer notifications. Monitor valuable actions after login, not only login itself.
What should happen when a customer account may be compromised?
Contain the account by ending suspicious sessions and protecting changes, help the customer recover through verified channels, review orders and data access, and document the result.
A quick store check
Review customer and administrator session duration, revocation, device visibility and password-change behavior.
Foundation · 2 min
Frequently asked questions
Should customers see active devices?
When feasible, device and session visibility helps users detect and end access they do not recognize.
Can a remember-me session last forever?
No. Persistent sessions still need an overall limit, revocation, and added verification for sensitive actions.