39 ms·
Surprisingly, there's several cookie-based approaches that forget to handle any sort of server-side expiration. Here's one: https://github.com/googleapis/nodej
by 8organicbits 3y ago
Surprisingly, there's several cookie-based approaches that forget to handle any sort of server-side expiration. Here's one:
https://github.com/googleapis/nodejs-firestore-session/issues/63 https://github.com/googleapis/nodejs-firestore-session/issue...
I agree that WebSession would benefit from a time since last touched expiration, although I'll point out that a time-based approach doesn't handle the "when device is locked" requirement.
- extraduder_ire 3y agoI've noticed reddit doesn't invalidate your cookies even if you click the logout button. There is a button in the site settings under your list of sessions, but I haven't tested that. I noticed it because I delete site cookies often, and paste them in from a file whenever I want to comment. Occasionally click "logout" without thinking. Got creeped out by that year-in-review thing they do once.