Ory is the largest open source community in the world for cloud software application security. We maintain advanced open source security software solving authentication, authorization, access control, application network security, and delegation. Ory implements a variety of industry and best-practice standards including OAuth 2.0 / OAuth 2.1, OpenID Connect, Zero Trust Networking, Google Zanzibar Policy Framework, FIDO2 U2F, WebAuthn, TOTP, and more.

Ory Community

hi, i'm trying to figure out how i can stay logged in, even after refreshing the page and calling `toSession`, despite the session being expired.
I try to submit a setting flow and get an error that I need to log in again to refresh the session, but then why does an expired session keeps hanging around in the cookies? Is this by design?
So every time I call `toSession` I should manually check if it's expired?

The cookie expiry should be set to the session expiry. Did you check it using devtools?

I permenantly have a cookie for my domain. 
I can sit there refreshing for hours, and will always get a session, despite it having an expiry of 10 minutes.