How secure are sessions and tokens?
- Topic
- Security & compliance
- Asked by
- Security teams
Session security is one of the hardest parts of auth, and Atlas handles it at the core:
Rotating tokens with reuse detection — a replayed or stolen refresh token is caught and the session is invalidated.
Constant-time (timing-safe) verification to prevent timing side-channels.
A signed JWKS endpoint so your backend services can verify session JWTs cryptographically without a network round-trip.
No tokens in URLs — sign-in and verification use one-time tickets, so tokens don't leak into browser history, logs or referrer headers.
Exact-origin redirect checks and CSRF-bound OAuth state to close open-redirect and CSRF holes.
See session and token security for the full model.
Session tokens are rotating and timing-safe, with reuse detection and constant-time verification, and Atlas publishes a signed JWKS so your services can verify tokens cryptographically. Tokens never travel in URLs.