- Shipped
- August 9, 2026 at 7:20 PM UTC
- Author
- Kamo
- Commit
- 76fe25d
This service keeps its own copy of KSessionService, and it slid the TTL on every read. Gating SecurityService alone therefore fixed nothing: kamo-internal points live chat, presence and support surfaces at this service and refreshes them on timers that keep running with nobody at the keyboard, so the same *** key was renewed here anyway and sessions never expired. Measured against production Redis: three live sessions sat pinned at ~1800s of a 1800s TTL, snapping back to full every 20-60s, while a session that only talked to SecurityService decayed cleanly to expiry. Honour X-Kamo-Idle-Ms the same way SecurityService does. APIService relays every header except Host, so the signal already reaches us. A caller that sends no header still renews, which keeps the WebSocket handshake — which cannot set headers — working exactly as before.