Better Auth queries the database on every session read unless the cookie cache is enabled

Sessions live in the session table and getSession validates against it, so middleware that calls it on every request adds a database round trip to every page view. In serverless or edge deployments there is no warm connection pool to amortize that, and it dominates latency.

Enabling session.cookieCache with an explicit maxAge stores a signed copy of the session and user in the cookie and serves reads from it until it expires. The tradeoff is staleness: revoking a session or changing a role does not take effect until the cached copy expires, so keep the window short, in the low hundreds of seconds, and use the library's revoke APIs which clear the cached cookie rather than deleting rows directly.