Entity that can be authenticated or authorized.

Cookie identifying a web session.

Time when a cookie becomes invalid.

Account used by software services.

Period after which a session expires.

Client-side storage available to web applications.

Identity assigned to a machine or workload.

Attack involving forced session identifiers.

Browser storage without automatic expiration.

Restricting access to resources.