Session
A session is the application-level context between client and server, created by CreateSession and made usable by ActivateSession. It carries the authenticated user identity, its own negotiated timeout, per-session diagnostics, and all the client's subscriptions, monitored items, continuation points and registered nodes. It is bound to one secure channel at a time but survives channel replacement.
Why creation and activation are separate
CreateSession does admission control and returns a server nonce plus the server certificate and endpoint list for verification. ActivateSession supplies the user identity token and a signature over that nonce, proving possession of the client private key. The split exists so identity can change later: calling ActivateSession again on a live session switches user without disturbing subscriptions, where the server supports it.
What lives inside the session
Subscriptions and their monitored items, browse continuation points, registered node handles, and the diagnostics node the server creates for you. When the session closes, all of it is deleted server-side unless subscriptions were transferred first. This is why session-per-tag-group designs are expensive: every session costs an RSA handshake, an admission check, diagnostics nodes and a slice of the server's MaxSessions budget.
Session limits and connect storms
A typical server handles on the order of a thousand concurrent sessions before connect throughput becomes bounded by handshake CPU. Connect storms are self-reinforcing: a handshake that times out makes the client retry, the retry builds a fresh session, and the original is orphaned until its timeout expires. Bounded exponential backoff on the client and staggered connects across a fleet are the effective mitigations.
Example
The session lifecycle and the errors around it
CreateSession(RequestedSessionTimeout=60000)
-> SessionId, AuthenticationToken, ServerNonce, RevisedSessionTimeout=30000
ActivateSession(UserIdentityToken, signature over ServerNonce)
-> Good
Using a session before ActivateSession -> BadSessionNotActivated
Using it after the server timed it out -> BadSessionIdInvalid
Using it after CloseSession -> BadSessionClosed
Server at its configured limit -> BadTooManySessionsDefined in: Part 4 - Services, Session Service Set (CreateSession, ActivateSession, CloseSession).
Last verified 7 September 2026 against OPC UA 1.05.07. OPC UA Connect is an educational resource and is not affiliated with the OPC Foundation.