GuideRuntime Security
Validating Sessions on Requests
How to validate active opaque tokens inside desktop clients and prevent client-side bypasses using periodic heartbeat checks and in-memory token verification.
Validation Strategy
Desktop applications should validate sessions under two triggers:
- On Startup / Feature Access: Immediately check validity before unlocking core binaries.
- Background Heartbeat Loop: Run a lightweight check every 5–15 minutes to capture cascade revocations or operator bans.
Session Validation Code
const validation = await client.sessions.validate({
token: sessionToken,
hwid: clientHwid,
});
if (!validation.valid) {
// Session is revoked or invalid: kick user to login screen
showLoginScreen();
} else {
// Session is authentic: proceed with feature execution
launchApplication(validation.user);
}