feat(auth): make the session TTL an inactivity timeout #22

Merged

elirtf merged 1 commit from worktree-session-idle-timeout into dev

2026-08-26 18:36:45 +00:00

elirtf commented

2026-08-26 18:36:41 +00:00

Owner

Rotate once an hour of the token's life has been used instead, so "exp" always
sits 24h after the last request. Idle past the TTL and the cookie's own expiry
logs the user out; stay active and the session never interrupts you.

Co-Authored-By: Claude Opus 5 noreply@anthropic.com
Claude-Session: https://claude.ai/code/session_0124fVy4aNte4hb94V5GARKT

OPUS_SESSION_LENGTH (24h default) already capped a session, but the JWT was only re-minted in its last 30 minutes — so it behaved as a fixed deadline from login, and an abandoned browser stayed logged in for the rest of that window with no concept of idleness at all. Rotate once an hour of the token's life has been used instead, so "exp" always sits 24h after the last request. Idle past the TTL and the cookie's own expiry logs the user out; stay active and the session never interrupts you. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0124fVy4aNte4hb94V5GARKT

elirtf added 1 commit

2026-08-26 18:36:41 +00:00

feat(auth): make the session TTL an inactivity timeout 2709f99dd9

OPUS_SESSION_LENGTH (24h default) already capped a session, but the JWT was only
re-minted in its last 30 minutes — so it behaved as a fixed deadline from login,
and an abandoned browser stayed logged in for the rest of that window with no
concept of idleness at all.

Rotate once an hour of the token's life has been used instead, so "exp" always
sits 24h after the last request. Idle past the TTL and the cookie's own expiry
logs the user out; stay active and the session never interrupts you.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0124fVy4aNte4hb94V5GARKT

elirtf merged commit 050d2e7f4f into dev

2026-08-26 18:36:45 +00:00

elirtf deleted branch worktree-session-idle-timeout

2026-08-26 18:36:45 +00:00

elirtf referenced this pull request from a commit

2026-08-26 18:36:45 +00:00

Merge pull request 'feat(auth): make the session TTL an inactivity timeout' (#22) from worktree-session-idle-timeout into dev