← Back to Labs

Session Lifecycle Simulator

Follow a browser session from anonymous state to login, validation, step-up auth, expiry, and revocation.

sidBrowsercookie jar__Host-session: noneGET /loginApp Servervalidation + authauth level: anonymousSet-Cookie: csrf=... onlySession Storeserver truthguest row onlyidle: n/aabsolute: n/atimeout gaterevoke allAnonymous state may exist. Authenticated state must start with a fresh id.Cookie carries the handle. Server-side state decides whether the browser is still trusted.
Step 1 / 7Anonymous browser gets only pre-auth state

Before login, the browser may have a CSRF token or a guest id, but it does not yet have an authenticated session.

Request: GET /login · Result: Set-Cookie: csrf=... only

Arrow keys to navigate · R to reset

Tap dots to jump to any step

Read the full article →Take the quiz →