My Sessions

1. What does this feature do? (High-Level Overview)

This feature lets a signed-in user review the devices currently connected to their account and remove the ones they do not recognize. It helps the user keep only trusted sessions active and gives a quick view of recent session activity.

2. Who is this for? (Roles & Permissions)

• Signed-in user: Can review their own sessions, sign out the current device, and revoke other active sessions.
• Regular users and parents: Can use the page because the feature is built for authenticated accounts, not just admin staff.
• Any authenticated account that can open the page: Sees the same personal session list for their own account.

Required access:

• User session access: The page is available from the account menu as My Sessions and is meant for the currently authenticated user.

3. Business Rules & Enforcements

• Rule 1: The page shows only the user’s own device sessions.
• Rule 2: The current device is highlighted separately so the user can identify the session they are using now.
• Rule 3: Sessions are shown with clear status labels so the user can distinguish the current device, other usable sessions, and revoked sessions.
• Rule 4: The page shows summary counts for total sessions, active sessions, revoked sessions, and other active sessions.
• Rule 5: The user can revoke one specific session at a time.
• Rule 6: The user can revoke all other active sessions at once and keep the current device active.
• Rule 7: The user can sign out the current device from this page.
• Rule 8: Revoked sessions remain visible for reference, but they do not offer any action buttons.
• Rule 9: Each session shows its device label, browser, operating system, IP address, last activity, and expiration time.
• Rule 10: The list is ordered by the most recent activity first, so the newest sessions appear earlier in the list.
• Rule 11: Loading and failure states are shown directly on the page.
• Rule 12: Action buttons are disabled while the related request is running.

4. UI Placement

1. Top account menu: Open My Sessions from the signed-in user’s menu.
2. Administration breadcrumb: The page is also shown under the Administration area in the breadcrumb trail.
3. My Sessions page: Review the summary cards and the device session list.
4. Action buttons: Use Revoke other sessions or Sign out this device when needed.

5. How-To Guide (Step-by-Step)

Scenario A: Review the devices signed into your account

1. Open the account menu and select My Sessions.
2. Review the highlighted current device.
3. Check the session list for any devices you do not recognize.
4. Use the browser, operating system, device label, IP address, and last activity to identify each session.

Scenario B: Revoke one specific device

1. Find the session you want to remove.
2. Click Revoke on that session.
3. Confirm the warning dialog.
4. Wait for the success message.
5. The session is marked as revoked so it can no longer keep refreshing as an active device session.

Scenario C: Revoke every other active session

1. Review the current device shown at the top of the page.
2. Click Revoke other sessions.
3. Confirm the warning dialog.
4. The system signs out all other active devices and keeps the current one active.

Scenario D: Sign out only the current device

1. Click Sign out this device.
2. Confirm the warning dialog.
3. The current device is signed out and the user is returned to the login screen.

6. What happens if…? (Edge Cases / FAQ)

• Q: What happens if there are no other active sessions?
  • A: The Revoke other sessions button is disabled.
• Q: What happens if the current device is not available?
  • A: The Sign out this device button is disabled.
• Q: What happens if a session was already revoked?
  • A: It stays listed for reference, but no action button is available for it.
• Q: What happens if loading the session list fails?
  • A: The page shows an error message and the session list is cleared.
• Q: What happens if the user confirms a revoke or sign-out action?
  • A: The page updates the session list after the action completes.
• Q: What happens if the session label is missing?
  • A: The page uses the browser, operating system, and device information to build a readable label.
• Q: What happens if a session expires but is still stored?
  • A: It can still appear in the list because the report shows stored sessions, not only currently usable ones.