Our system never had sessions that expired. A recent hack at the client caused us to revisit the security measures we had in place.

The person who was on the project since it's start 8 years ago was tasked with fixing this issue. It has a simple solution: add session expiration, and extend the session to an hour from now with each request.

This week I found out how he did it🤦🏻‍♂️. He added session expirations, but extended the session by an hour with each request. By making 10 requests in quick succession, your session is extended by 10 hours.