Chapter 12

1. Most of the time, sessions – both user and client – are not stored in the database. As you learnt from Chapter 9, Configuring Keycloak for Production, sessions are stored in-memory and shared across the different cluster nodes. However, there is a specific type of session called an offline session that is stored in the database. For more details about offline sessions, look at the documentation at https://www.keycloak.org/docs/latest/server_admin/#_offline-access.
2. User sessions hold state about the authenticated user, regardless of the client. On the other hand, client sessions are bound to the client the user authenticated with and they hold the state about the user within the context of a specific client.
3. Keycloak provides different ways for revoking tokens and expiring sessions. As you learnt from this chapter, tokens can be revoked by invoking the revocation endpoint and the sessions can be destroyed through the administration console...