Should you extend session expiration in all API endpoints?

[musjj]

Should you always extend the session lifetime in all API endpoints (that requires session authentication) or should you only do it in specific endpoints e.g. /api/auth/session?

I'm using GraphQL where your API is divided into queries and mutations and you're only supposed to mutate the database in mutations. But this means that queries that needs authentication can potentially mutate the database, so I'm not sure if this is a good approach.

[harshagarwalnyu]

The standard approach is to extend on every authenticated request, but with a threshold check so you're not hitting the database on every single call.

Lucia's own docs recommend something like this - only refresh if the session is past the halfway point to expiry:

const SESSION_DURATION_MS = 30 * 24 * 60 * 60 * 1000 // 30 days

async function validateAndRefreshSession(sessionId: string) {
  const { session, user } = await lucia.validateSession(sessionId)
  if (!session) return { session: null, user: null }

  // only extend if we're in the second half of the session lifetime
  if (Date.now() >= session.expiresAt.getTime() - SESSION_DURATION_MS / 2) {
    await lucia.extendSession(session.id)
  }

  return { session, user }
}

For your GraphQL concern: extending a session is a metadata operation on the auth layer, not a business mutation. It's fine to do inside query resolvers. Think of it the same way as setting a response cookie or updating a lastSeen timestamp - it doesn't violate the semantic distinction between queries and mutations at the data layer. The GraphQL spec's mutation-for-side-effects rule is about your application data, not infrastructure like auth.

You could also do the refresh at the middleware/context level before your resolvers run, which keeps it completely out of the resolver layer.