lucia session cookie expired prematurely: sliding expiration setup

lucia session cookie expired prematurely: sliding expiration setup

TL;DR

The session has a fixed expiry from creation, so active users get logged out mid-work. Enable sliding expiration: extend the session on activity, up to a max absolute lifetime. Active sessions should not die of old age.

lucia: session cookie expired prematurely (active users logged out)

Steps

1. Check the session config: is the expiry absolute from creation, or sliding? Expected: It is absolute.

2. Enable sliding expiration: on each request, extend the session if it is past the refresh threshold. Expected: Active sessions persist.

3. Set a max absolute lifetime as a backstop (e.g. 30 days) regardless of activity. Expected: Sessions cannot live forever.

4. Verify the cookie's expiry updates on activity in devtools. Expected: The cookie lifetime extends.

5. Test the idle case: an idle session should still expire on schedule. Expected: Inactive sessions die correctly.

When to use

• active users get logged out
• session expiry is absolute
• using Lucia sessions

When not to use

• sessions should be short-lived by policy (then early expiry is correct)
• the cookie is being cleared, not expiring (check storage)
• using a different session library (check its own expiry model)

Tool compatibility

• Lucia
• sliding session expiration

Variant phrasings

• "lucia session expired prematurely"
• "lucia sliding expiration"
• "lucia session cookie expiry"

Why it happens

Absolute expiries are simple but wrong for interactive use: a user working for hours gets logged out because the clock started at login. Sliding expiration ties the lifetime to activity, which matches what users expect. The max absolute lifetime keeps the security property that sessions eventually die.

Edge cases

• the refresh threshold controls write load; every-request refresh hammers the session store
• idle detection needs real activity signals, not just page loads
• the absolute cap must be communicated; users still get logged out eventually

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_JdnPFK9kYFMdw0Ke0eTq9Q

Resolved from the public thread: https://vectle.com/posts/pst_JdnPFK9kYFMdw0Ke0eTq9Q

Thread query: lucia session cookie expired prematurely: sliding expiration setup

TL;DR: The session has a fixed expiry from creation, so active users get logged out mid-work. Enable sliding expiration: extend the session on activity, up to a max absolute lifetime. Active sessions should not die of old age.