Session expiry recovery
A recovered draft still needs current permission
Reauthentication proves an identity now. It does not automatically authorise an old action or transfer a previous user's saved work.
In this article
Bind recovery to the right context
Store draft ownership and organisation association on the server where server drafts are used. Validate access whenever the draft is retrieved or submitted.
For local recovery state, treat client identifiers as hints rather than authority. The server must reject a request that substitutes another account's draft ID.
Use a synthetic case where a person belongs to two organisations. Switching organisation after sign-in must not make a draft from the first available under the second's context.
Recheck the intended action
Permissions, record status and approval requirements can change while a session is expired. Revalidate them before applying the recovered command.
A project manager may prepare an approval before their role is removed. Restoring their text can be appropriate under policy, but executing the approval still requires current authority.
For higher-risk actions, use the established reauthentication or step-up requirements. Do not treat any recent page login as sufficient evidence for every operation.
Protect the recovery mechanism itself
Validate internal return destinations and avoid exposing sensitive state in URLs. Keep credentials out of diagnostic exports and draft storage.
Review cached data after logout and account changes. A stale query response should not repopulate the interface with the previous account's information after the new session begins.
Define the disposition of local drafts on shared devices. Preserving work and protecting confidentiality can conflict, so the product needs a deliberate policy and clear user communication.
Test denial and legitimate restoration
Attempt cross-account draft reads, changed organisation IDs and replay of a command whose permission has been revoked. Verify rejection at the server and an understandable recovery state in the interface.
Then restore a valid draft under its authorised owner and confirm that required fields and attachments remain. A security control that destroys all work may prevent misuse while failing the intended product workflow.
Record access decisions without logging session secrets. The evidence should identify the actor, resource and decision sufficiently for investigation while preserving the secrecy of the authentication mechanism.
Primary sources
OWASP: authenticationOWASP: session managementReferences checked 11 September 2026.