Enforce server-side session idle expiry with sliding TTL

2026-07-23 22:09:59 +08:00
parent 97a81a9e41
commit 77d1134569
4 changed files with 154 additions and 19 deletions
@@ -24,6 +24,21 @@ async def home(ctx: HttpContext):
 Sessions are created lazily: a cookie is only set when the handler modifies the
 session.

+## Session expiry
+
+The cookie sent to the browser has a `Max-Age` (default 14 days), but that is
+only a client-side hint. The real boundary is the store's server-side TTL,
+which the middleware keeps in sync with the cookie `Max-Age`.
+
+For `InMemorySessionStore`, a session expires if it is idle for longer than
+`max_age`. Active sessions have their expiry slid forward on every access, so
+a user that keeps visiting stays logged in. If the client ignores the cookie's
+`Max-Age` and replays an old cookie value, the store rejects the expired
+session and creates a fresh empty one.
+
+Set `max_age=None` to disable server-side expiry (and the `Max-Age` cookie
+attribute) entirely.
+
 ## Features

 - `Session`: dict-like session object with modification tracking