Remove client address and adding cron to remove stale sessions every day at 2AM.

src/hooks.server.ts

@@ -17,7 +17,7 @@ export const authentication: Handle = async function ({ event, resolve }) {
 
 	const ip = event.request.headers.get('x-forwarded-for') as string;
 	const country = event.request.headers.get('x-vercel-ip-country') as string;
-	event.locals.ip = dev ? '127.0.0.1' : ip || event.getClientAddress();
+	event.locals.ip = dev ? '127.0.0.1' : ip; // || event.getClientAddress();
 	event.locals.country = dev ? 'us' : country;
 
 	const sessionId = event.cookies.get(lucia.sessionCookieName);

src/routes/api/crons/cleanupSessions/+server.ts

@@ -0,0 +1,11 @@
+import type { RequestHandler } from "@sveltejs/kit";
+import { lucia } from "$lib/server/auth";
+
+export const GET: RequestHandler = async ({ request }) => {
+	if (request?.headers?.get('Authorization') === `Bearer ${process.env.CRON_SECRET}`) {
+		await lucia.deleteExpiredSessions();
+		return new Response('Success', { status: 200 });
+	} else {
+		return new Response('Unauthorized', { status: 401 });
+	}
+}

vercel.json

@@ -0,0 +1,8 @@
+{
+	"crons": [
+		{
+			"path": "/api/crons/cleanupSessions",
+			"schedule": "0 2 * * *"
+		}
+	]
+}