What a session actually is, and why signing in is hard

A session is a small record with a lifespan, and the difficulty lies at its edges.

A session is simply information the site keeps about one continuing visit, tied to a marker the visitor presents. It might hold who they are, what they have selected, where they were up to. It lives somewhere durable, it has a beginning, and it must have an end. Almost every session problem is a problem with one of those edges: it began when it should not have, it lasted longer than it should, or it ended somewhere the visitor did not expect.

Signing in looks like one comparison and is not. A stored secret must never be readable, even by the people who hold it, which means storing something derived from it rather than the thing itself. Repeated failed attempts must be slowed, or the process becomes an invitation. The response to a wrong name and a wrong secret should be indistinguishable, because a helpful distinction is a free hint. And a successful sign-in should replace the marker rather than reuse it, so that a session begun before the sign-in cannot inherit its privileges.

Then come the edges nobody thinks of at first. Two devices at once. A password changed while another device is still signed in. A session that should be ended everywhere immediately. A visitor who closes the tab and returns a week later. None of these is exotic, all of them are ordinary life, and each needs a deliberate answer. This is why recognition, the most invisible feature on any site, absorbs a disproportionate share of the care.