Without session isolation, the next user can inherit authenticated access from the previous user, even if the kiosk is locked down. That creates unauthorized access to data or functions, weakens attribution, and can disrupt shift handoffs. The failure is not just technical. It is a governance gap between device restriction and identity state.
Why shared kiosk access fails without session isolation
Shared kiosks are designed to be convenient, but convenience changes nothing if the previous user’s authenticated session is still live. The core failure is that the device is restricted, yet the identity state is not reset. In practice, the next person may inherit access to the prior user’s data, approvals, workflows, or transactions.
That means the control boundary is in the wrong place. Locking the screen or hardening the device does not prevent reuse of an active session token, browser state, or application login if the session is not explicitly ended or isolated between users.
In a well-designed kiosk flow, the session must end cleanly when the user finishes, times out, or hands off the device. If that does not happen, the kiosk becomes a shared trust surface where access persists longer than intended. The problem is especially visible when the application allows the browser, app cache, or authentication context to survive across users.
What actually breaks in the access model
Without session isolation, the next user can act as if they are the prior user until the application or identity layer forces reauthentication. That can expose personal records, internal functions, payment or order actions, support queues, or administrative views depending on what the kiosk can reach.
Attribution also degrades. If a user can continue an existing session, activity logs may show the wrong person as the actor, or no clear boundary at all between one user and the next. That weakens auditability, incident investigation, and accountability for transactions completed on a shared device.
Handoff becomes fragile too. Many kiosk workflows depend on one person completing a step and the next person continuing the queue, shift task, or service process. If the previous session is still active, the handoff may be silent and unsafe, because the next user is not starting from a clean identity state.
Why this is an identity and governance problem, not just a device problem
The relevant control failure is that the session, not the kiosk, carries authority. If the browser or app session remains valid, the device can be locked down perfectly and still deliver unauthorized access. That is why session lifecycle, logout enforcement, timeout policy, and token invalidation matter as much as physical access rules.
This is also where governance enters. A kiosk policy that says “shared device” is incomplete unless it defines what must happen to credentials, sessions, local state, and cached application context at each user change. MITRE D3FEND Guide is useful here because the defensive problem is not just access control, but session mediation, artifact clearing, and reducing the residue left behind for the next user.
Microsoft SAS token exposure 2023 is a reminder that long-lived access material is dangerous when it outlives the user or workflow that was supposed to own it. The same logic applies to kiosk sessions: if authority persists beyond the intended user boundary, exposure can persist with it.
Where the boundary needs to be enforced
Session isolation has to be enforced at the application layer, the authentication layer, and the device handoff layer together. If any one of those layers fails, a user can inherit access through cookies, tokens, browser state, or app memory even when the screen appears locked.
The cleanest design is explicit termination at logout, automatic expiry after inactivity, and a fresh authentication challenge before any new user can resume access. In addition, kiosk sessions should avoid storing reusable credentials locally, because local persistence makes the next-user problem much harder to contain.
When the kiosk supports sensitive actions, the application should require a fresh trust decision for each user boundary, not merely for each device boundary. That is the difference between “this machine is managed” and “this person is authorized right now.”
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5, OWASP ASVS and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | Session isolation depends on timely invalidation of reusable auth material. |
| AC-12 — Session Termination | Directly addresses ending user sessions on shared devices. | |
| AC-3 — Access Enforcement | Shared kiosk access still needs per-user enforcement, not only device control. | |
| Recommendation — Invalidate reused session material at handoff and enforce short-lived authentication state. Enforce automatic and explicit session termination when kiosk use ends. Apply access decisions to each user session rather than trusting the kiosk itself. | ||
| OWASP ASVS | V7 — Session Management | Shared kiosk failures are usually session lifetime and reuse failures. |
| Recommendation — Require fresh session handling, logout invalidation, and idle timeout for shared devices. | ||
| CIS Controls v8 | CIS-6 — Access Control Management | Kiosk handoff risk is reduced by strict account and access control enforcement. |
| Recommendation — Restrict shared access paths and remove residual access at every user transition. | ||
Practitioner Guidance
What to verify: Confirm that logout actually invalidates the server-side session, not just the visible browser state. If a second user can return to the same authenticated page, the control is failing even if the kiosk is physically protected.
Decision rule: If the kiosk can reach any system that exposes data or performs actions on behalf of a user, require hard session reset at handoff and treat any reusable session artifact as a security boundary violation.
What good looks like: Each user starts from a blank session, prior tokens are unusable, cached state is cleared, and audit logs clearly separate one user action stream from the next.
Practitioner takeaway: Shared kiosks are safe only when the access grant is time-bounded to the person, not just the device. If identity state survives the handoff, the kiosk is no longer a shared terminal, it is a continuation of the previous user’s authority.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 22, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org