They treat signing in as the main risk and forgetting to sign out as a minor mistake. In reality, the active session is the trust asset. If it remains open, another user may inherit access without the password, which turns convenience into unauthorised access.
Why This Matters for Security Teams
Shared devices are common in frontline operations, healthcare, education, retail, call centres, and field work, which makes session handling a practical security issue rather than a niche usability problem. The mistake is assuming authentication ends the risk. In reality, the session often carries the real authority, especially where apps keep tokens, remember devices, or maintain browser persistence after the password has been entered.
That matters because session misuse can bypass MFA, defeat password resets, and create confusing audit trails. A user can walk away from a kiosk, a loaned tablet, or a shared workstation and leave a live session behind for the next person. That is why session timeout, reauthentication, device-locking behaviour, and logout controls need to be treated as part of access governance, not just endpoint hygiene. NIST guidance on access control and session management in NIST SP 800-53 Rev 5 Security and Privacy Controls reinforces that organisations should bound the duration of access and protect session state, not merely credentials.
In practice, many security teams discover the weakness only after one user has acted inside another user’s still-open session, rather than through deliberate session lifecycle design.
How It Works in Practice
On shared devices, safety depends on how the application and the operating system manage the session from start to finish. A password authenticates the person, but a cookie, token, device certificate, or persistent login state keeps that person effectively present. If that state is not cleared or expires too slowly, the next user can inherit access without needing to know the password.
Good practice starts with shortening the lifetime of privileged or sensitive sessions, forcing reauthentication for high-risk actions, and binding sessions to the device context where appropriate. Organisations should also make sure logout is real logout: browser cookies, app caches, refresh tokens, and local credentials need to be removed or invalidated. Where the environment supports it, application-level idle timeout, absolute session timeout, and step-up authentication create layered protection. Session controls should also be coordinated with endpoint controls such as screen locking, browser isolation, and kiosk mode.
Practically, teams should validate the following:
- Idle sessions time out quickly enough for the actual workplace pattern.
- Logout invalidates server-side session state, not only the visible browser window.
- Privileged actions require step-up authentication even after sign-in.
- Shared devices do not retain autofill, remembered accounts, or cached tokens.
- Audit logs distinguish the original user from the session holder when possible.
For identity-aware environments, this also intersects with privileged access and non-human workflow controls, especially when service accounts, remote support tools, or delegated admin sessions are used on shared endpoints. OWASP’s guidance on session management and authentication risk is useful here, and the OWASP Session Management Cheat Sheet is a practical reference for hardening session lifecycle decisions. These controls tend to break down when legacy web apps cannot invalidate tokens centrally because the session survives outside the application boundary.
Common Variations and Edge Cases
Tighter session controls often increase user friction, so organisations need to balance convenience against the operational cost of repeated authentication. That tradeoff is especially visible in shift-based environments, where forcing re-login too often can drive workarounds such as shared credentials, unattended sessions, or informal exceptions.
There is no universal standard for this yet because the right timeout depends on device ownership, threat level, and workflow sensitivity. Kiosks and public terminals usually justify aggressive session expiry and mandatory logout, while managed corporate laptops may support more flexible policies if the device itself is strongly protected. Risk-based reauthentication can help, but it should not be used as an excuse to leave long-lived sessions active on shared endpoints.
Edge cases also matter for remote support, temporary staff, and emergency access. In those situations, the best practice is to separate identity proofing from session continuation and to ensure administrative sessions are clearly scoped, logged, and terminated. Where browser-based apps are used across multiple people, clearing local storage and blocking persistent login features becomes as important as password policy. For broader access governance, the Zero Trust perspective in NIST SP 800-207 Zero Trust Architecture supports continuous verification rather than one-time trust. In mixed trust environments, session controls often fail when the device is shared but the application assumes a single accountable user.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 address the attack and risk surface, while NIST CSF 2.0, NIST Zero Trust (SP 800-207), NIST SP 800-53 Rev 5 and NIST SP 800-63 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | PR.AC-3 | Session safety depends on access being managed and revoked when needed. |
| NIST Zero Trust (SP 800-207) | Shared devices benefit from continuous verification instead of one-time trust. | |
| OWASP Non-Human Identity Top 10 | Shared sessions can expose delegated and non-human credentials on the endpoint. | |
| NIST SP 800-53 Rev 5 | AC-12 | Control requires session termination after inactivity or logout. |
| NIST SP 800-63 | Reauthentication strength matters when a session is resumed on a shared device. |
Inventory session-bearing identities and ensure shared devices cannot retain their credentials.
