Engineering Lab 02 / Identity
Understand the session boundary before it breaks.
Walk through session expiry, rotated refresh credentials, replay detection, and tenant authorization. This is a synthetic educational demo and never authenticates a real user.
Offline / Synthetic model
Change the session state
Explore refresh rotation, revocation, and cross-tenant denial. All identities and responses are simulated in your browser.
Simulated server decision
SIGNED OUTRefresh rotation: 0
No session exists. Every resource requires server-side authorization.
Decision history
- No session exists. Every resource requires server-side authorization.
This educational model is not a real identity provider, threat scanner, or security assessment. A client can never be the final authority for tenant or session access.
Need code-level remediation? See the scoped engineering approach.