Once authentication completes, the session token typically persists for 8 to 12 hours in most enterprise environments. Some applications extend this to 24 hours or longer. During that entire window, anyone with the token operates as the authenticated user.
A token stolen through phishing, malware, or a man-in-the-browser attack grants the attacker the same 8 to 12 hours of trusted access. There is no re-verification. There is no behavioral check. The system trusts the token.
The Productivity Tradeoff
Shortening token duration disrupts productivity. If sessions expire every 30 minutes, users face constant re-authentication. This creates friction, reduces adoption, and generates help desk volume. Organizations choose longer token durations because the alternative hurts operations.
Continuous session authentication resolves this tradeoff. The token can stay long. The trust does not have to. Behavioral verification runs continuously inside the session regardless of token duration. If the entity operating the session changes, enforcement triggers immediately. The legitimate user is never interrupted. The impersonator is caught.
Sources: OWASP Session Management guidelines. NIST Digital Identity Guidelines (SP 800-63B).