4.2 Session Store Availability

A Redis session store is read on every authenticated request, so its health decides whether users can stay logged in. The previous lesson built the design: a random 128-bit session ID in a hardened cookie, a small hash per session under a sess: prefix, sliding expiry with an absolute cap, a new ID at login, and revocation by deleting the key.

This lesson covers the second risk of that design