You can re-verify on the backend however often you like. Make the signed cookie include user-id and date (and maybe a session id). Accept it without backend-ch

You can re-verify on the backend however often you like. Make the signed cookie include user-id and date (and maybe a session id). Accept it without backend-check while it's less than X minutes old. Buf if it's older than that, check the backend to see if the user has invalidated sessions since it was generated. In the typical all-good case, generate a new signed cookie and put it in the response. No need for service workers or anything. A web company I worked for a couple years ago implemented something almost exactly like this while I was there.