# Ghost member cookie expiration - in database, or?

**URL:** <https://forum.ghost.org/t/ghost-member-cookie-expiration-in-database-or/36894>\
**Category:** Developer help\
**Created:** [March 7, 2023, 12:30am UTC](https://forum.ghost.org/t/ghost-member-cookie-expiration-in-database-or/36894 "2023-03-07T00:30:21Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Cathy\_Sarisky](https://sea1.discourse-cdn.com/flex015/user_avatar/forum.ghost.org/cathy_sarisky/32/25750_2.png) [@Cathy\_Sarisky](https://forum.ghost.org/u/Cathy_Sarisky)\
**Post date:** [March 7, 2023, 12:30am UTC](https://forum.ghost.org/t/ghost-member-cookie-expiration-in-database-or/36894/1 "2023-03-07T00:30:21Z")

</div>

So here’s a completely random question: I can find the code that sets cookies after a user follows a magic link and trades their token for a cookie. Those cookies get 184 days / 6 months for their expiration date.

What I can’t find is where Ghost checks that a cookie it is offered is not expired. Are cookie expirations handled server side, or is the client trusted to expire them? I’m asking because I’m working on a job where I’ve got a proxy adding a cookie. It works great today, but is Ghost going to refuse that cookie in six months?

I’ve been through the code and looked for a MySQL table, but I’m not finding anything that looks like expired cookies being invalidated. Help??

Thanks!

---

<div class="post-metadata">

**Author:** ![vikaspotluri123](https://sea1.discourse-cdn.com/flex015/user_avatar/forum.ghost.org/vikaspotluri123/32/24_2.png) [@vikaspotluri123](https://forum.ghost.org/u/vikaspotluri123)\
**Post date:** [March 7, 2023, 2:35am UTC](https://forum.ghost.org/t/ghost-member-cookie-expiration-in-database-or/36894/2 "2023-03-07T02:35:25Z")

</div>

Cookie expiration is managed by the browser! In the case of Members auth, the logic for authenticating is [here](https://github.com/TryGhost/Ghost/blob/5a6b9e6d84683611f72826145f8f65a73da70e2c/ghost/members-ssr/lib/MembersSSR.js#L203-L241), and you can see that there’s only a cookie set to log a member in.

---

<div class="post-metadata">

**Author:** ![Cathy\_Sarisky](https://sea1.discourse-cdn.com/flex015/user_avatar/forum.ghost.org/cathy_sarisky/32/25750_2.png) [@Cathy\_Sarisky](https://forum.ghost.org/u/Cathy_Sarisky)\
**Post date:** [March 7, 2023, 2:55am UTC](https://forum.ghost.org/t/ghost-member-cookie-expiration-in-database-or/36894/3 "2023-03-07T02:55:22Z")

</div>

Thanks @vikaspotluri123 ! That’s what I suspected, but I worried I was perhaps missing some code elsewhere. (And I know enough systems that store a session ID in the backend that /does/ expire to be cautious about assuming it was all browser-based.)