struct

KemalIdentity::Sessions::Config

Inherits Struct < Value < Object

Session lifetimes. Boot-time and immutable, like every other piece of configuration (docs/01-architecture.md): nothing mutates it after startup, so no request can widen a window.

Constructors

new(idle_timeout : Time::Span = 2.hours, absolute_timeout : Time::Span = 12.hours, touch_interval : Time::Span = 60.seconds, revoke_current_on_credential_change : Bool = false)
Source

Instance methods

absolute_timeout

How long a session survives at all, no matter how active. Activity extends idle_expires_at; it never touches this.

Source
idle_timeout

How long a session survives without activity.

Source
revoke_current_on_credential_change?

Whether a credential change revokes the session it was performed from, along with all the others.

Default false: changing your own password should not log you out of the tab you changed it in. Every other session dies either way — that is not configurable, since the whole point of revoking on password change is to evict whoever knew the old one.

Source
touch_interval

How stale last_seen_at may get before a read is allowed to write.

Idle expiry naively means an UPDATE on every authenticated request, which turns a read-only hot path into a write-heavy one — the single biggest performance trap in this design. Throttling it means idle expiry is accurate only to within one touch_interval, and that inaccuracy is part of the contract rather than an implementation accident (docs/02-security-model.md).

Source