How to manage session expiration settings on OKX web login?

Session Management Architecture

1. OKX web login does not rely on traditional server-side session storage. It implements stateless authentication using JWT tokens issued upon successful credential verification.

2. Each login generates a short-lived access token with a fixed 2-hour validity window, enforced strictly at the API gateway level.

3. Refresh tokens are stored encrypted in browser IndexedDB and remain valid for 30 days unless revoked manually or triggered by security events.

4. Token expiration is embedded in the JWT payload as the exp claim, verified cryptographically on every request to backend services.

5. No client-side configuration options exist to modify default token lifetimes; all durations are hardcoded in OKX’s identity service layer.

Automatic Token Renewal Flow

1. The OKX frontend monitors token expiry timestamps in real time using performance.now() and internal timers.

2. When remaining validity drops below 90 seconds, the system initiates silent refresh via POST /api/v5/users/login-renew endpoint.

3. Renewal requires re-signing of the refresh token with HMAC-SHA256 using a rotating key derived from user-specific entropy.

4. Failed renewal attempts trigger immediate UI redirection to the login page without exposing raw error codes to end users.

5. Concurrent sessions across devices are allowed but subject to per-account concurrency limits defined in OKX’s risk policy engine.

Security Enforcement Mechanisms

1. All token validation occurs within OKX’s hardened auth microservice, isolated from public internet exposure.

2. Session hijacking protection includes binding tokens to TLS fingerprint, IP geolocation stability, and device canvas hash.

3. Suspicious activity such as rapid token refresh cycles or cross-continent IP jumps trigger automatic token invalidation.

4. Browser storage permissions enforce strict Content Security Policy directives preventing unauthorized script injection into token storage contexts.

5. Logout operations perform synchronous revocation across all active sessions via distributed Redis pub/sub channels.

Browser-Level Session Controls

1. OKX enforces SameSite=Strict cookie attributes for all authentication-related cookies to prevent CSRF exploitation.

2. The HttpOnly flag is set on session cookies to block JavaScript access to sensitive authentication material.

3. LocalStorage usage is prohibited for storing any credentials or tokens; only IndexedDB with encryption-at-rest is permitted.

4. Cache-Control headers mandate no-store directives for all endpoints returning session-sensitive data.

5. Web Workers handle cryptographic operations off the main thread to mitigate timing side-channel attacks.

Frequently Asked Questions

Q: Can I extend my access token beyond two hours manually?No. Access tokens have immutable lifetimes. Only the automated refresh mechanism can obtain new tokens before expiration.

Q: Does clearing browser cookies immediately invalidate my session?Yes. Clearing cookies removes the HttpOnly session cookie, forcing re-authentication even if the access token remains valid in memory.

Q: Why does OKX use IndexedDB instead of localStorage for refresh tokens?IndexedDB supports asynchronous encryption APIs and provides better isolation boundaries against XSS payloads compared to synchronous localStorage operations.

Q: Are session timeouts affected by browser sleep mode or network disconnection?No. Expiration is calculated server-side using UTC timestamps. Client clock drift is compensated by synchronizing with OKX’s NTP servers during initial handshake.