session-based-access-control-pattern

name	session-based-access-control-pattern
description	Security pattern combining session authentication with authorization. Use when implementing web application security requiring both user authentication via session IDs and authorization checks for resource access. Combines Opaque token-based authentication with Authorisation pattern.

Session-Based Access Control Security Pattern

Combines session-based authentication (opaque tokens) with authorization. Subject is first authenticated via session ID, then authorized based on their principal's privileges before action execution.

Core Components

Role	Type	Responsibility
Subject	Entity	Requests actions with session ID
Authentication Enforcer	Enforcement Point	Verifies session ID
Verifier	Decision Point	Validates session, retrieves principal
Session Manager	Entity	Maintains open sessions
Session ID Generator	Cryptographic Primitive	Generates secure session IDs
Authorisation Enforcer	Enforcement Point	Checks action authorization
Decider	Decision Point	Makes authorization decisions
Policy Provider	Information Point	Manages access policies

Data Elements

• sessionId: Opaque token identifying session
• principal: Authenticated identity