Unresolved Behavior: Credential Expiration Handling in Racket Auth Module

Goal

Determine whether Racket’s built‑in racket/auth module automatically invalidates credentials once their credential-expiration timestamp passes, or whether this enforcement must be handled entirely by application code.

Current Constraints

• The auth module provides require-credentials to guard handlers, but it returns a generic 401 for both invalid and expired credentials.
• Session cookies can be given an expiration attribute, yet the auth module offers no standard API to expire credentials server‑side.
• Documentation mentions a credential-expiration field, yet runtime checks for this field are absent.
• Behavior appears to vary between Racket 8.12 and 9.0, with no clear consensus in the release notes.

Unresolved Decision

Should the auth module automatically enforce credential expiration, or should developers implement their own checks? The library’s current design leaves this choice ambiguous, impacting least‑privilege security guarantees.

Specific Questions

• Does the racket/auth module provide any built‑in mechanism to invalidate credentials once the credential-expiration timestamp is reached?
• Which Racket release should the auth module adopt a standard API for server‑side credential expiration, if any?
• Can the require-credentials form be extended or configured to distinguish between expired and merely invalid credentials?