Two-Factor Authentication, Sessions & Auto Logout

AXQA combines password authentication with Email OTP Two-Factor Authentication, session controls, and configurable inactivity logout.
Administrative accounts receive stronger authentication requirements, while session validation helps prevent previously issued access from being reused incorrectly.

Why it matters

• Adds another verification step beyond the account password.
• Protects administrative accounts with stronger authentication requirements.
• Reduces risk from unattended authenticated sessions.
• Allows active sessions to be invalidated when session identity changes.

When to use it

• When protecting administrative accounts.
• When users require additional account security.
• When configuring workspace inactivity policies.
• When investigating revoked or unexpected sessions.

Core concepts

• 2FA – Two-Factor Authentication requiring an additional verification code.
• Email OTP – A temporary verification code delivered to the user's registered email.
• Single-Device Session – Session control that validates the currently authorized session and device identity.
• Session Revocation – Invalidating previously active session information.
• Auto Logout – Automatic logout after a configurable period of inactivity.

How it works

1. The user provides their normal AXQA credentials.
2. AXQA determines whether the user requires 2FA.
3. When required, a temporary Email OTP is issued.
4. The user verifies the OTP.
5. AXQA establishes the authenticated session.
6. Session and device identity are validated during later protected requests.
7. If the stored session identity no longer matches the active session, AXQA revokes access.
8. Inactive authenticated sessions are automatically logged out after the configured timeout.

How to use it

Step 1: Understand who requires 2FA

AXQA requires Two-Factor Authentication for:

• Staff users
• Superusers
• Accounts explicitly configured to require 2FA

Normal users can also use 2FA when enabled for their account.

Step 2: Complete Email OTP verification

When 2FA is required:

1. AXQA sends a temporary verification code to the registered email.
2. Enter the code in the verification flow.
3. AXQA verifies the code before completing authentication.

The verification code is temporary and can only be used according to its active verification state.

Step 3: Understand OTP protection

AXQA protects Email OTP verification using:

• Expiration
• Maximum verification attempts
• One-time use
• Hashed OTP storage

The original OTP code is not stored as plain reusable authentication data.

Step 4: Understand session protection

AXQA maintains active session and device identity for authenticated users.

If the active session or device no longer matches the expected identity, the previous session is revoked and the user must authenticate again.

Step 5: Configure Auto Logout

Open:

Security → Auto Logout

Set the inactivity timeout in minutes.

When an authenticated user remains inactive longer than the configured period, AXQA logs the user out automatically.

Best practices

• Require 2FA for privileged users.
• Protect access to the email account receiving OTP codes.
• Never share OTP codes.
• Use a reasonable inactivity timeout for sensitive workspaces.
• Re-authenticate when AXQA reports that a session was revoked.
• Do not share user accounts between team members.

Common mistakes

❌ Sharing an OTP code with another person.
✔ Treat OTP codes as temporary authentication credentials.

❌ Leaving privileged accounts signed in on unattended devices.
✔ Use appropriate Auto Logout settings and lock the device.

❌ Assuming an old browser session will remain valid after the active session changes.
✔ AXQA can revoke mismatched session identity and require a new login.

Security & permissions

• Staff and Superuser accounts are required to complete the configured 2FA setup.
• OTP values are stored as secure hashes rather than reusable plain-text verification codes.
• OTP verification includes expiration and attempt controls.
• Session identity is checked before protected operations continue.
• Auto Logout configuration is restricted to Superusers.
• Automatic logout events are recorded as security activity.

Related documentation

• Login Attempts Blocker & Rate Limiting
• Security Log Tracker & Live Security Monitoring
• IP Whitelist Security
• Security Architecture Overview