I think it's reasonable to unset cookies at client side whenever the session is destroyed. (At least actix-sessions does this.)
Also, in my opinion it's a much nicer experience to avoid panics, because that causes the response to hang and never arrive. Instead, on storage failure we should send back a 500 INTERNAL_SERVER_ERROR. Also added tracing errors to appropriate places.
Let me know what do you think about these changes.
I think it's reasonable to unset cookies at client side whenever the session is destroyed. (At least actix-sessions does this.)
Also, in my opinion it's a much nicer experience to avoid panics, because that causes the response to hang and never arrive. Instead, on storage failure we should send back a 500 INTERNAL_SERVER_ERROR. Also added tracing errors to appropriate places.
Let me know what do you think about these changes.