Pattern of creating a database record for every user login and injecting its id into the browser's cookie session, so that every subsequent request identifies the active session. Enables counting concurrent sessions per user, expiring specific sessions on logout or MFA conditions, and collecting per-login data (IP, geo, user agent, CloudFront headers). Core data-collection mechanism in the Prevent Account Sharing talk and precondition for enforcing a cap on concurrent sessions.