The answer
No. The server must compare the session's expiration and revocation state on protected requests. Background cleanup timing must not extend a user's authenticated access.
How do database-backed sessions support authentication?
Can a wedding session remain valid until its expired database record is deleted?
More FAQs in How do database-backed sessions support authentication?
No. The session establishes identity. Each protected operation must also verify the user's current permissions and relationship to the specific wedding being accessed.
An existing session identifier may still be usable if the server record remains valid. Invalidate the server-side session as well as clearing the browser cookie.
Still have questions?
Browse all our FAQs or reach out to our support team
Want to upskill yourself?
Your learning library
Small steps. Big possibilities.
Find your next course. Build something great.