Authentication & sessions
How a session is established, maintained and ended.
Establishing a session
Credentials are verified against Cognito. On success the application holds a bearer token rather than a host-locked cookie — which is what allows a tenant subdomain and the shared address to share one session model.
Lifetime
- Tokens refresh silently while a user is active.
- A session is per browser. Signing in on a laptop does not sign you in on a phone.
- Signing out clears the session on that browser only.
Rotation on role switch
Switching between roles on a multi-role account issues a fresh session identifier rather than reusing the existing one, so a session cannot carry privileges across a role boundary.
Scoped tokens
The paper-capture handoff deliberately avoids a full session. Scanning the QR code opens a page holding a short-lived token scoped to uploading scans for one session and nothing else. A phone used to photograph answer sheets never holds a teacher session.
Guest attempts
Open Quiz guests hold no session. The link token identifies the quiz, one attempt is bound to one session so it cannot be restarted for a better score, and the guest can reach nothing else in the platform.