---
title: Session lifecycle or replay control may be missing
description: >-
  Investigates stale sessions, replayable signed links, and missing invalidation
  or idempotency across lifecycle transitions.
source_url:
  html: >-
    https://shopify.dev/docs/apps/build/security/app-security-checks/session-lifecycle-and-replay
  md: >-
    https://shopify.dev/docs/apps/build/security/app-security-checks/session-lifecycle-and-replay.md
---

# Session lifecycle or replay control may be missing

Investigates stale sessions, replayable signed links, and missing invalidation or idempotency across lifecycle transitions.

| Detail | Value |
| - | - |
| Check ID | `SESSION_LIFECYCLE_AND_REPLAY` |
| Severity | High |
| How it runs | Agent review |

***

## Vulnerable example

## app/routes/webhooks.app.uninstalled.tsx

```tsx
import type { ActionFunctionArgs } from "react-router";


import { authenticate } from "../shopify.server";


export const action = async ({ request }: ActionFunctionArgs) => {
  const { shop } = await authenticate.webhook(request);


  // Shopify revokes the access token on uninstall, but the
  // session rows stay behind. Code that treats a stored session
  // as proof the shop still has the app installed keeps trusting
  // a shop that removed it.
  console.log(`Uninstalled: ${shop}`);


  return new Response();
};
```

***

## How to fix

Invalidate stale authority and enforce replay protection or re-authorization before sensitive actions.

## app/routes/webhooks.app.uninstalled.tsx

```tsx
import type { ActionFunctionArgs } from "react-router";


import { authenticate } from "../shopify.server";
import prisma from "../db.server";


export const action = async ({ request }: ActionFunctionArgs) => {
  const { shop, session } = await authenticate.webhook(request);


  // Delete the shop's sessions on uninstall. Do the same on
  // logout, scope downgrade, and account disconnect.
  if (session) await prisma.session.deleteMany({ where: { shop } });


  return new Response();
};
```

***

## Related

* [`shopify app security check`](https://shopify.dev/docs/api/shopify-cli/app/app-security-check), the command that runs this check
* [All app security checks](https://shopify.dev/docs/apps/build/security/app-security-checks)

***