Getting Started
Overview Quickstart
Monitors
Overview Monitor Types Intervals & Probes Advanced Options
Status Pages
Overview Setup Customization Custom Domains Uptime History
Incidents
Overview Managing Incidents Maintenance Windows
Agent
Installation Configuration Upgrading Uninstallation Requirements Troubleshooting
Plugins
Overview Redis MySQL PostgreSQL MongoDB Nginx Apache PHP-FPM Memcached RabbitMQ Elasticsearch Meilisearch Varnish HAProxy Docker VictoriaMetrics mdadm (RAID)
API
Overview Authentication Monitors Incidents Status Pages Errors
RUM & Replay
Overview Quickstart Session Replay Custom Events Error Tracking Troubleshooting
OTLP & Tracing
Overview Distributed Traces Structured Logs Custom Metrics Language SDKs Troubleshooting
Observability Apps
Overview Creating Apps Quota Management Domain Whitelist Top-Up Credits
Alert Manager
Overview Anomaly Detection Alert Channels Thresholds
Teams
Overview Roles & Permissions Invitations Seats & Billing
Billing
Overview Plans & Quotas Top-up Credits Invoices & Portal
Security
Overview Two-Factor Auth API Tokens Sessions

Session Management

Every time you log in from a browser or device, StatusRadar creates a server-side session. Session management lets you see all of your active sessions and revoke any you no longer want β€” useful after logging in on a shared computer, or if you suspect unauthorized access.

Sessions are managed under Settings β†’ Security (/dashboard/settings?tab=security).

How Sessions Work

  • Sessions are server-side and Redis-backed, identified by the STATUSRADAR_SESSION cookie.
  • The cookie is HttpOnly, Secure, and SameSite=None (so you stay logged in after a Stripe redirect).
  • Revoking a session destroys it on the server immediately β€” the corresponding browser is logged out on its next request.

Viewing Active Sessions

The Active Sessions list shows each session tied to your account, including the device/browser context and which entry is your current session. Review this list periodically and after using any machine you don't fully trust.

Revoking a Single Session

To log out a specific device, find it in the list and revoke it. The session is destroyed and that browser is signed out.

You cannot revoke the session you are currently using from this list. To end your current session, use Log out instead.

Revoking All Other Sessions

If you want to sign out everywhere except where you are right now β€” for example after a suspected compromise or a password change β€” use Revoke All Other Sessions. This destroys every session except your current one, forcing every other device to log in again.

This is a good step to take when:

  • You changed your password and want to invalidate older logins (this is not automatic).
  • You logged in somewhere and forgot to log out.
  • You suspect your account was accessed from a device you don't control.

Relationship to Other Security Controls

  • Changing your password does not revoke other sessions automatically. Revoke them explicitly afterward if needed.
  • Enabling or disabling 2FA affects future logins, not currently active sessions. Revoke sessions to force re-authentication with the new setting.
  • Revoking an API token is separate from sessions β€” it stops programmatic API access but does not affect browser logins. See API Tokens.

Next Steps

On this page