lucia-auth / lucia

Authentication, simple and clean
https://lucia-auth.com
MIT License
8.32k stars 447 forks source link

[SOLVED]: Session lifetime never extended even though the user is actively using the app. #1608

Closed kapsule-studio closed 1 week ago

kapsule-studio commented 1 week ago

Package

lucia

Describe the bug

The documentation says Sessions do not have an absolute expiration. The expiration gets extended whenever they're used. This ensures that active users remain signed in, while inactive users are signed out.

Yet, everyday at some point I get signed out of my app as I'm active on it (building the app). Here's my implementation, using the Drizzle adapter:

Any help would be greatly appreciated!

const adapter = new DrizzlePostgreSQLAdapter(db, session, user)

export const lucia = new Lucia(adapter, {
  sessionCookie: {
    name: SESSION_COOKIE,
    expires: true,
    attributes: {
      secure: !DEV,
      sameSite: 'lax'
    }
  },
  sessionExpiresIn: new TimeSpan(1, 'd'),
  getUserAttributes: user => user
})
Kawba commented 1 week ago

Which FE Framework are you using?

There is a note in the NextJS getting started guide (https://lucia-auth.com/getting-started/nextjs-app) that "Next.js doesn't allow Lucia to extend cookie expiration when rendering pages" so instead they suggestion is to just set long cookie expiration times.

If your not using NextJS might be best to drop some details of that you are using in, there may be a similar issue / limitation with the framework you are using!

kapsule-studio commented 1 week ago

Oh thank you, I am indeed using Nextjs. I guess I've overlooked that part of the docs, or it wasn't there at the time I've implemented Lucia, 6-7 months ago.

Anyway, by reading a little more, I've found that the adapter has an updateSessionExpiration() method that I could use. I don't want sessions that never expire no matter the activity of the user. I'll go for that method with a Cron job on top and it should be fine.

pilcrowOnPaper commented 1 week ago

Also, if you set the expiration to a day, the session will only be extended when there's less than 12 hours (1/2 day) to the expiration. Closing this as expected behavior

Arctomachine commented 1 week ago

Is there tutorial on how to optimally implement manual session update?