Sessions that expire themselves

A user logs in. You PUT their session blob to kv/session:abc123 with ?ttl=3600. One hour later, the key is gone. You wrote no cleanup cron, you ran no Redis instance, you configured no eviction policy.

Every request that needs the session does a GET on the same URL. If it's there, the user is logged in. If it's gone, the user is logged out. The next login is another PUT with another TTL. Sessions live and die inside one HTTP verb each.

Refresh a session by re-PUT-ing: the TTL clock restarts. Revoke a session by DELETE: the user is logged out before the TTL would have fired. There's no scheduled job, no expiry sweeper, no memory pressure to plan for. The expiry is a property of the row, not a job.

TTL turned session management into a single PUT.