Database-backed sessions: expiry, revocation, and secure cookies

Own Auth returns an opaque session token to the application and stores its protected hash with the session record. Each lookup enforces revocation, user status, absolute expiry, and idle expiry before returning the current user and session.

Store the session token

Web applications can place the token in a Secure HttpOnly cookie. Native applications can keep it in the platform credential store and send it to the application backend.

response.cookies.set("own_auth_session", sessionToken, {
  httpOnly: true,
  secure: process.env.NODE_ENV === "production",
  sameSite: "lax",
  path: "/",
  expires: session.expiresAt,
});

Verify before protected work

const currentAuth = await auth.getCurrentSession(sessionToken);
if (!currentAuth) return null;

return currentAuth;

Use the returned user and session for the request. Product authorization remains in application code, including access to records that belong to a user or organisation.

Use both absolute and idle expiry

• Absolute expiry limits the maximum lifetime even when the account stays active.
• Idle expiry ends sessions that have not been used within the configured window.
• Revocation ends one device or all devices before either timer expires.
• Disabling a user makes every session ineffective immediately.

Revoke without waiting for expiry

Revoking a session changes its database state immediately. The next call to auth.getCurrentSession returns null, even when the client still has the raw token. Own Auth can revoke one session or every session for a user.