Responsibility for session lifespan management

[davidoram]

Hi, I'm working on a blog post that describes integrating a Go application with Krytos.

One thing isn't clear to me is the recommended best practice for protecting routes that require that the user is logged in. I've started with middleware that calls the WhoAmI API on every request. My thinking is that then Krytos can expire the session as per its config (session.lifespan).

Is that the recommended approach?

[aeneasr]

Yes, that is recommended! We’re also working on a proxy which has some caching built in to make this stuff less costly. However it is the only way to ensure that when your users sign out they are signed out!

[davidoram]

Many thanks @aeneasr 👍