Six beliefs about sessions, checked
Six beliefs that between them account for most of the surprise a session causes. Each is checked against a sample and given a verdict.
- beliefs
- 6
- false
- 4
- partly
- 1
- true
- 1
Four of the six beliefs are false, one is partly true and one is true. The idle timeout counts from your last counted action rather than from sign-in; staying active cannot postpone the absolute lifetime; a sign-out does not touch a placed bet; a deposit and a bet need no second password; an account can hold several sessions at once; and a clock never clears a device.
The six, one at a time
Belief 1 - the 30 minutes runs from when I signed in
It runs from the last counted action. On sample A the sign-in was 09:00 and the ending was 10:11, because activity at 09:41 restarted the clock.
falseBelief 2 - if I keep clicking, nothing can sign me out
Clicking postpones the idle clock and cannot touch the absolute lifetime. On sample A a click at 20:59 still leaves the ending at 21:00.
falseBelief 3 - being signed out loses the bet I had on
The bet is held by the account. On sample E it settled 440 minutes after it was placed, all of it after the session ended.
falseBelief 4 - every action asks for the password again
Three of six do, and they are the actions that can move money out or change the credential. A bet and a deposit are not among them.
falseBelief 5 - my account can only be open in one place
It can hold several sessions at once, up to a published limit, and a new sign-in at the limit ends the oldest rather than being refused.
partlyBelief 6 - waiting long enough clears a shared device
The clocks end the interval and remove no token. Only a sign-out or a revocation does, and the token can run for 30 days.
trueWhat the beliefs have in common
Each of the four false beliefs moves a property from one object to the other: the account's permanence onto the interval, or the interval's brevity onto the account. Sample D is the arithmetic that breaks the habit - 1,440 idle windows inside a single persistent token - and the five endings are the list that shows which actions actually remove it.
- Read the two clocks as two limits rather than one, and beliefs 1 and 2 fall together.
- Ask which object holds a thing - the account or the session - before expecting a sign-out to change it.
- Do not assume every action is rechecked; half the sample list goes through without a password.
- Expect several sessions at once, and expect the oldest to end first.
- Remember that waiting is not a control: only a sign-out or a revocation clears a device.