[8organicbits]

Surprisingly, there's several cookie-based approaches that forget to handle any sort of server-side expiration. Here's one:

https://github.com/googleapis/nodejs-firestore-session/issue...

I agree that WebSession would benefit from a time since last touched expiration, although I'll point out that a time-based approach doesn't handle the "when device is locked" requirement.

[extraduder_ire]

I've noticed reddit doesn't invalidate your cookies even if you click the logout button. There is a button in the site settings under your list of sessions, but I haven't tested that.

I noticed it because I delete site cookies often, and paste them in from a file whenever I want to comment. Occasionally click "logout" without thinking. Got creeped out by that year-in-review thing they do once.