{
  "id": 2396335,
  "title": "Extending the Login Session to 1 Year for Kiosk‑Mode TV Screens (Next.js API Route)",
  "url": "https://urgent.news/2026/08/21/extending-the-login-session-to-1-year-for-kiosk-mode-tv-screens-next",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-08-21T15:22:25.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/zaerohell/extending-the-login-session-to-1-year-for-kiosk-mode-tv-screens-nextjs-api-route-da7"
  },
  "original_language": "en",
  "account": "The source material details a change made to extend the login session session lifetime for kiosk-mode TV screens protected by JWT-based authentication. The key facts are:\n\n1. The original cookie maxAge was set to 30 days (60 days * 60 minutes * 24 hours * 30 days) in src/app/api/login/route.ts.\n2. Kiosk TVs are turned on weekly and expected to stay signed in for months, not 30 days. The current cookie expiration caused a 401 Unauthorized error after 30 days.\n3. An attempted fix involved refreshing the token on each API call via a middleware, but this caused rate limiting issues, state leakage, and added latency.\n4. The final solution was to simply increase the cookie maxAge from 30 to 365 days (1 year) in the same auth flow without adding complexity. This change is implemented in the same POST route handler in src/app/api/login/route.ts.\n5. The implementation diff changes the maxAge line from 60 * 60 * 24 * 30 to 60 * 60 * 24 * 365.\n6. The security posture remains the same with httpOnly, secure, and lax SameSite flags on the cookie.\n7. The change simplifies the API surface by eliminating the need for a refresh endpoint and keeps the code environment-agnostic across development and production.",
  "summary": "Extending the Login Session to 1 Year for Kiosk‑Mode TV Screens (Next.js API Route) TL;DR: I changed the maxAge of the auth cookie from 30 days to 365 days in src/app/api/login/route.ts . The tweak lets a TV kiosk stay logged in without a daily refresh, while keeping the same security flags. The Problem Our kiosk‑mode deployment runs on large‑format TVs that display a live dashboard. The UI is…",
  "key_points": [
    "Original cookie maxAge set to 30 days in login route.",
    "Kiosk TVs need months-long sessions, not 30 days.",
    "Increased cookie maxAge to 365 days for stability."
  ],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}