Cyberlop sign-in sessions use short-lived access tokens plus rotating refresh tokens, held in HttpOnly, SameSite and Secure cookies. Refresh tokens rotate each time, and reusing an old one revokes all sessions. The app stores session and API tokens only as hashes.
The short version
Your session has two parts. A short-lived access token proves who you are for a few minutes at a time, and a refresh token quietly renews it. Both live in cookies that scripts on the page cannot read.
| Feature | What it does |
|---|---|
| Short-lived access token | Limits how long a stolen token works |
| Rotating refresh token | Gives a new token on every refresh |
| Reuse detection | Revokes all sessions if an old refresh token appears again |
| HttpOnly, SameSite, Secure cookies | Keep tokens away from page scripts and plain HTTP |
| Hashed storage | Cyberlop stores only hashes of session and API tokens |
How it works in Cyberlop
Each time the app refreshes your session, it rotates the refresh token and issues a new one. The API reference describes the call as one that rotates the refresh token and issues a new session. An old token stops working as soon as the new one exists.
If someone presents an old refresh token again, Cyberlop treats it as a sign of theft and revokes all sessions for that account. The real owner signs in again, and the thief is out.
The cookie flags do separate jobs. HttpOnly hides the cookie from page scripts. SameSite limits when other sites can trigger requests with it. Secure keeps it off plain HTTP. Signing out revokes the session and clears the cookies.
API tokens work differently. Cyberlop shows the raw secret once when you create it and keeps only a hash afterwards, so a lost token needs replacing and cannot be recovered.
What to do next
- If you were signed out everywhere, read why all sessions ended.
- For tokens, see what to do about a lost API token.
- Add a second factor with Require MFA.
Questions? Use /contact.
Related questions
- Why was I suddenly signed out of all my sessions?
- How are user passwords stored?
- I lost my API token. Can I see it again?
- Is traffic to and from Cyberlop encrypted?
- How do I make two-factor authentication mandatory for my workspace?
Cyberlop API tokens and permissions: how to issue and limit them
Step-by-step, with annotated screenshots.
Updated · Back to the help centre
Security question we did not answer?
Our team will answer it directly, or walk through it on a call with your security lead.