How can I check for Laravel session expiration without inadvertently renewing it?

Below is one proven approach: stop “touching” the session on your ping endpoint by not booting the session middleware (or at least not calling methods that update it) so your check is read-only. For example, instead of using the session instance and calling Auth::check() (which by its very nature will read from—and update—the session), you can do the following:

1. Read the session ID directly from the cookie, and use that to query the database table manually.
2. Remove (or bypass) any middleware that writes to the session so that your read doesn’t reset the last_activity.

A sample route might look like this:

PHPCopied
use Illuminate\Http\Request;
use Illuminate\Support\Facades\DB;
use Illuminate\Support\Facades\Cookie;

Route::get('/session-status', function (Request $request) {
    // Get the session ID directly from the cookie.
    $sessionId = Cookie::get(config('session.cookie'));

    if (!$sessionId) {
        // No session cookie? Treat as expired.
        return response()->json(['session_expired' => true], 401);
    }

    // Query the sessions table directly without loading the session.
    $session = DB::table('sessions')
        ->select('last_activity')
        ->where('id', $sessionId)
        ->first();

    if ($session) {
        $sessionLifetime = config('session.lifetime') * 60;
        $sessionAge = now()->timestamp - $session->last_activity;

        if ($sessionAge > $sessionLifetime) {
            return response()->json(['session_expired' => true], 401);
        }
    } else {
        // No session record found, so treat as expired.
        return response()->json(['session_expired' => true], 401);
    }

    return response()->json(['session_expired' => false]);
})
// Remove session middleware so this endpoint does not touch session data.
->withoutMiddleware([\Illuminate\Session\Middleware\StartSession::class])
->name('session.status');

A few notes on this approach:

• By grabbing the session ID directly from the cookie (using Cookie::get(...)) and querying the database, you avoid calling any methods (like Auth::check() or $request->session()) which would load and update the session data.
• The use of withoutMiddleware ensures that Laravel does not run the StartSession middleware on this endpoint. That way your “ping” won’t renew the session’s last_activity value.
• Because you’re bypassing the session middleware, you won’t have access to Auth-related functionality on this route. (If you need to authenticate the user without updating the session, consider using a stateless token or similar mechanism for this specific endpoint.)

On the frontend your axios call remains the same:

JAVASCRIPTCopied
const showPopup = ref(false);

const checkSession = async () => {
    try {
        await axios.get('/api/session-status');
    } catch (error) {
        if (error.response && error.response.status === 401) {
            showPopup.value = true;
        }
    }
};

// Run session check every minute (60000 ms)
onMounted(() => {
    setInterval(checkSession, 60000);
});

With this design, your session’s last_activity is not updated by the check endpoint, so if a user truly becomes inactive the natural expiry will occur.