“NextAuth + Redis: Expired sessions remain in storage after maxAge”

[david-yan-1]

Hey, I’ve noticed a difference in how sessions are handled with NextAuth + Upstash Redis:

• "When a user signs out, the session token is removed from Redis as expected."
• "When a session simply expires (based on maxAge), the token is cleared from the browser cookies, but the corresponding Redis entry remains. There’s no TTL set on the Redis key, so expired sessions stick around indefinitely."

Is this the intended behavior (because NextAuth enforces expiry via the expires field instead of TTL), or should Redis sessions also auto-expire? Just want to confirm whether this is by design or if it’s a bug.

For context, here’s my session config:

import { NextAuthConfig } from "next-auth";
import MicrosoftEntraID from "next-auth/providers/microsoft-entra-id";
import { UpstashRedisAdapter } from "@auth/upstash-redis-adapter";
import { Redis } from "@upstash/redis";
import { AdapterSession } from "next-auth/adapters";

const redis = new Redis({
  url: process.env.REDIS_API_URL,
  token: process.env.REDIS_API_TOKEN,
});

const authConfig = {
  providers: [
    MicrosoftEntraID({
      clientId: process.env.AUTH_ID,
      clientSecret: process.env.AUTH_SECRET,
      issuer: `https://login.microsoftonline.com/${process.env.AUTH_TENANT_ID}/v2.0`,
  session: {
    maxAge: 30, // 30 seconds for testing
    strategy: "database",
  },
  adapter: UpstashRedisAdapter(redis),
} satisfies NextAuthConfig;