refactor(session): Extend session expiry and add renewal threshold

- Increase session expiry from 24 hours to 7 days
- Add a 1-day threshold for session renewal when user status is online
- Prevent unnecessary session token regeneration if session has sufficient remaining time

commit: d5464c368263df358f66e4e5294813a1ac8d369f
author: Kit · 20mo ago · 2025-02-19 06:51 UTC
parent: 334edb8
signature: SSH UnverifiedSHA256:H91DFuEG4jpk5edzLA4aUKkpv4zv9Q339ipRmkph6Tk The key is unknown

2 files · +13 -9

M src/lib/api/session.server.ts +1 -1


@@ -54,7 +54,7 @@ export async function createSession(token: string, userId: string): Promise<Sess
54	54		log.debug("Creating session", { userId });
55	55		const sessionId = await sha256(token);
56	56		const createdAt = Date.now();
57		-	const expiresAt = createdAt + 24 * 60 * 60 * 1000; // 24 hours expiry
	57	+	const expiresAt = createdAt + 7 * 24 * 60 * 60 * 1000; // 7 days expiry
58	58		await db.insert(sessions).values({
59	59		id: sessionId,
60	60		userId,


@@ -54,7 +54,7 @@ export async function createSession(token: string, userId: string): Promise<Sess
54		log.debug("Creating session", { userId });	54		log.debug("Creating session", { userId });
55		const sessionId = await sha256(token);	55		const sessionId = await sha256(token);
56		const createdAt = Date.now();	56		const createdAt = Date.now();
57	-	const expiresAt = createdAt + 24 * 60 * 60 * 1000; // 24 hours expiry	57	+	const expiresAt = createdAt + 7 * 24 * 60 * 60 * 1000; // 7 days expiry
58		await db.insert(sessions).values({	58		await db.insert(sessions).values({
59		id: sessionId,	59		id: sessionId,
60		userId,	60		userId,

M src/routes/api/status/+server.ts +12 -8


@@ -47,19 +47,23 @@ export const POST: RequestHandler = async ({ request, cookies, locals }) => {
47	47		.get();
48	48		log.debug('Database updated successfully', { userId: maskedUserId, status });
49	49
50		-	// Renew session if status is online
	50	+	// Renew session if status is online and session expires in less than 1 day
51	51		if (status === 'online') {
52	52		const token = cookies.get('session');
53	53		if (token) {
54	54		const result = await validateSessionToken(token);
55	55		if (result.session) {
56		-	const newToken = generateSessionToken();
57		-	const newSession = await createSession(newToken, userId);
58		-	setSessionTokenCookie({ cookies }, newToken, newSession.expiresAt);
59		-	log.info('Session renewed', {
60		-	userId: maskedUserId,
61		-	expiresAt: new Date(newSession.expiresAt).toISOString()
62		-	});
	56	+	const remaining = result.session.expiresAt - now;
	57	+	const threshold = 24 * 60 * 60 * 1000; // 1 day in milliseconds
	58	+	if (remaining < threshold) {
	59	+	const newToken = generateSessionToken();
	60	+	const newSession = await createSession(newToken, userId);
	61	+	setSessionTokenCookie({ cookies }, newToken, newSession.expiresAt);
	62	+	log.info('Session renewed', {
	63	+	userId: maskedUserId,
	64	+	expiresAt: new Date(newSession.expiresAt).toISOString()
	65	+	});
	66	+	}
63	67		}
64	68		}
65	69		}

             .get();
         log.debug('Database updated successfully', { userId: maskedUserId, status });
-        // Renew session if status is online
+        // Renew session if status is online and session expires in less than 1 day
         if (status === 'online') {
             const token = cookies.get('session');
             if (token) {
                 const result = await validateSessionToken(token);
                 if (result.session) {
-                    const newToken = generateSessionToken();
+                    const remaining = result.session.expiresAt - now;
-                    const newSession = await createSession(newToken, userId);
+                    const threshold = 24 * 60 * 60 * 1000; // 1 day in milliseconds
-                    setSessionTokenCookie({ cookies }, newToken, newSession.expiresAt);
+                    if (remaining < threshold) {
-                    log.info('Session renewed', {
+                        const newToken = generateSessionToken();
-                        userId: maskedUserId,
+                        const newSession = await createSession(newToken, userId);
-                        expiresAt: new Date(newSession.expiresAt).toISOString()
+                        setSessionTokenCookie({ cookies }, newToken, newSession.expiresAt);
-                    });
+                        log.info('Session renewed', {
+                            userId: maskedUserId,
+                            expiresAt: new Date(newSession.expiresAt).toISOString()
+                        });
+                    }
                 }
             }
         }