# `PhoenixKitWeb.Users.Session`
[🔗](https://github.com/BeamLabEU/phoenix_kit/blob/v2.2.0/lib/phoenix_kit_web/users/session.ex#L1)

Controller for handling user session management.

This controller manages user login and logout operations, including:
- Creating new sessions via email/password authentication
- Handling post-registration and password update flows
- Session termination (logout)
- GET-based logout for direct URL access

## Security Features

- Prevents user enumeration by not disclosing whether an email is registered
- Supports remember me functionality via UserAuth module
- Session renewal on login/logout to prevent fixation attacks

# `add_account`

# `create`

# `delete`

# `get_logout`

# `impersonate`

Adds a user to the session stack on an administrator's authority — the
"log in as this user" button in the admin area.

The authority checks live in `MultiSession.impersonate/2`; this action only
translates their outcome into a flash. Each refusal says which rule stopped it,
because "could not do that" on a support tool is how an operator ends up
guessing at permissions.

The precise refusals are for operators, so the actor's authority is settled
BEFORE the uuid is resolved. The other order hands every signed-in user — the
gate admits all of them, it only asks that the root session be real — a
distinct "User not found." for an unused uuid and a different message for a
used one, which is an account-existence oracle wearing a support tool's copy.

# `remove_account`

# `set_active_account`

---

*Consult [api-reference.md](api-reference.md) for complete listing*