​
Session storage

After login, the platform stores a JWT in browser localStorage under the key serviceToken. The token is sent on every API request:
Default server expiration is configured via backend TOKEN_EXPIRATION (typically 12 hours).

​
What happens on page refresh

  1. App reads serviceToken from storage
  2. Validates JWT expiry client-side
  3. Calls GET /user/verifyToken to confirm with server
  4. Restores user profile and reconnects Socket.IO
Until verification completes, a loading screen is shown.

​
Logout

Click Logout in the header:
  1. POST /user/logout/:userId invalidates server session
  2. Token removed from storage
  3. Socket disconnected
  4. Browser navigates to /login

​
Session expiry

When the token expires or API returns 401:
  • Axios interceptor redirects to /login
  • User must sign in again

​
Single session / force login

The backend can reject login if the user is already active elsewhere. Use Force Login on the login form to terminate the other session.

​
Socket coupling

A valid app session also opens a Socket.IO connection tagged with your userId. Logout closes this connection; stale tabs may miss real-time updates until re-login.

​
Profile updates

Editing /profile updates the user document but keeps the same token unless password change triggers re-auth on the server.