# Session and recovery review checklist
- Model authenticated, expired, revoked and pending-recovery states.
- Validate refresh credentials using server-managed state.
- Consume and rotate single-use refresh credentials atomically.
- Never mint a session based only on a local UI signal.
- Require independent recovery evidence and step-up.
- Rate-limit abuse paths and invalidate old sessions after recovery.
- Log outcomes without tokens or recovery codes.

Sources:
https://datatracker.ietf.org/doc/html/rfc9700
https://cheatsheetseries.owasp.org/cheatsheets/Logging_Cheat_Sheet.html