How to Use This Tool
Combine absolute, idle, rotation and revocation limits without estimating attack probability. Calculate bounded session exposure windows from explicit lifetime, idle timeout, token rotation and revocation-delay assumptions.
The decision this tool supports
A policy can list several timeout values while leaving reviewers unable to see which path actually limits a stolen session token. This page keeps the decision bounded to rotation-bounded exposure and the supporting outputs shown beside it. Session Exposure Window does not import an account, infer a market rate, or silently substitute an industry average.
Inputs and units
The Session Exposure Window calculation uses Absolute session lifetime, Idle timeout, Token rotation interval, Revocation propagation delay. Keep all money values in one currency and all time, distance, mass, energy or volume entries in the unit printed beside the field. Mixing Session Exposure Window scopes can produce a plausible number with the wrong meaning.
- Absolute session lifetime is entered in hours.
- Idle timeout is entered in minutes.
- Token rotation interval is entered in minutes.
- Revocation propagation delay is entered in minutes.
Formula and worked check
Rotation-bounded exposure = min(absolute lifetime, rotation interval) + revocation delay; the idle path substitutes idle timeout. An eight-hour lifetime, 30-minute idle limit, 60-minute rotation and five-minute propagation delay produce 65- and 35-minute modeled paths. The Session Exposure Window default is an executable known-answer case, not a benchmark or recommendation. Change one input and verify that the direction of rotation-bounded exposure still matches the stated relationship.
How to interpret the result
Treat the smallest path as a configured bound only; validate actual server revocation and refresh-token behavior in integration tests. The additional Session Exposure Window outputs expose the denominator, comparison, capacity or reverse value needed to audit the primary result instead of presenting one unexplained number.
Assumptions
- Rotation invalidates the prior token after the entered propagation delay.
- Absolute and idle timeouts are enforced server-side.
- All durations use the same policy scope.
Save the Session Exposure Window input values and date with any material decision. A later Session Exposure Window rerun is reproducible only when the same assumptions and units are available.
Limitations and safety boundary
The model does not estimate compromise likelihood, browser theft, clock drift, refresh-token reuse, offline validation or implementation defects. Session Exposure Window is an estimate and cannot replace a contract, local code, licensed professional, calibrated measurement, lender statement or platform report where one governs the decision.
Source and privacy
The Session Exposure Window definition or rule was checked against OWASP Session Management Cheat Sheet on 2026-08-26. Recheck OWASP Session Management Cheat Sheet when a specification or policy behind Session Exposure Window can change. Session Exposure Window arithmetic runs in this browser tab; ecech does not receive the values through a calculation API.
Sources & assumptions
Tool Spec v2 · verified 2026-08-26. Platform rules and fees can change; the editable inputs remain authoritative for your account.
Official references
- OWASP Session Management Cheat Sheet (checked 2026-08-26)
Model assumptions
- Rotation invalidates the prior token after the entered propagation delay.
- Absolute and idle timeouts are enforced server-side.
- All durations use the same policy scope.
- The model does not estimate compromise likelihood, browser theft, clock drift, refresh-token reuse, offline validation or implementation defects.
