I have run into this issue: <https://youtrack.jetb...

# ktor

[Norbi]

I have run into this issue: https://youtrack.jetbrains.com/issue/KTOR-5760
Isn't it a security problem that the server depends entirely on the client regarding session validity?
Thanks.

[ephemient]

cookie expiry is a client-side feature only, the server has no idea what the cookie expiry is beyond setting its initial value (it never gets re-transmitted). that's just how cookies work

[ephemient]

so yes, that does mean if you want server-controlled session expiration then you can't (only) use cookie expiration