People must be able to see active sessions
Aliases: logged-in devices · session list · where you're signed in
What it is
When the same account holds live sessions on a phone, computer, tablet, and the web, people often do not know who else is still in. Seeing active sessions means account security settings list every session the server still honors: a coarse device or browser name, rough place, last activity, and which row is “the one you are looking at.” This entry is only about visibility. It does not include tapping to end a remote session, and it does not include the system pushing an unusual-sign-in notice.
Why it happens
A session is authorization on the server; the device has no natural family portrait. After a library computer or selling an old phone, closing the window is mistaken for sign-out while the token still lives. Without a list, unauthorized occupancy is discovered through side effects—bills, read receipts—late and vague. The list turns invisible parallel logins into recognizable rows so “devices I remember” can be checked against “a row I do not.” Rows must be distinct enough (not all “Chrome on Windows”) without being precise enough for a bystander to track a route. The current session must be marked, or people kick themselves off.
Studying it
Give a multi-device account, with and without a session list, and measure how quickly and accurately people notice “another machine is still on.”
Independent variables: whether a list exists, fields (device name, place, time, current marker), live refresh versus a snapshot on open. Dependent variables: correctly identifying a stranger session, mistaking the current session for a stranger, time from settings to finding the list.
Lab devices are few and cleanly named; real lists fill with “unknown device” and VPN-misplaced cities. Bad place data lowers trust; separate “the field is wrong” from “the person cannot find the entry.” Clicking “security settings” is not success—count whether people can count the sessions correctly.
Where it stops holding
When an enterprise IdP owns sessions, the in-app list may be a read-only mirror and should point at the IdP. One-shot OTP logins that never became durable sessions should not appear as ghost rows in “active devices.” Privacy-sensitive users reject precise geolocation; city-level or “rough area” is usually enough for recognition. For child or supervised accounts, who may see the list is a guardianship question; do not default to showing the child every parent device.
Applying it
- Put a “signed-in devices / sessions” page in account security or settings: coarse device name, rough place, last activity, current session marked.
- Prefer the model the device reports or a name the person once chose; if missing, browser plus OS—not “session #4.”
- Fetch server truth on open and say “may lag by a few minutes,” so the list is not mistaken for a chat-style presence indicator.
- Verify: after a second device signs in, someone uninvolved in the design finds the list on the first device and points at the new row, then at “which row is the one you are using.” Missing the entry, miscounting rows, or marking the wrong current session fails.