zsh — hocein@dev:~/loading
hocein@dev:~$ fetch --page
loading route
loading route
// dev log
A field report on building Better-Auth sessions with HTTP-only cookies, rotating tokens, and a cache layer that survives deploys.
Sessions live in an HTTP-only cookie so the browser owns the token and JavaScript never touches it. The server stores a hash of the session token — never the raw value — so a leaked database never hands over live sessions.
Every read of a session rotates its token, invalidating the previous one. A stolen token is only useful until the next request, which dramatically shrinks the window an attacker can operate in.
Session state lives in a shared cache layer so restarts and rolling deploys don't drop every logged-in user. The cache is the source of truth; the cookie is just the key.