Class SessionService

How many keys can open a cookie, for the health indicator.

How the cookie is protected, for the health indicator.

Which strategy is in effect, for the health indicator.

Releases store resources; called from the plugin's onClose.

Writes the session back, when it needs writing.

A clean session emits no header at all: committing on every request would rewrite the cookie on pure reads and defeat downstream caching.

Returns the session the middleware loaded for this request.

This is the single entry point: the middleware, route handlers, the CSRF middleware, and framework bridges all read the same instance, so no caller can observe a differently-configured session.

Opens a session from a Headers object alone — the headers-only read for non-HTTP entry points that have no request context to commit onto (a WebSocket onOpen handler, an auth strategy reading a cookie).

Read-only by contract: it runs the same envelope-open, snapshot-parse, and store-read path as SessionService.load but never advances the session's seen stamp, never commits, and never writes to the store. It returns null for every condition load treats as "no usable session" — the cookie is absent or empty, the envelope cannot be opened, the snapshot cannot be parsed, the absolute expiry or idle timeout has passed, or (on the store strategy) the stored entry is gone.

Loads the session for a request, falling back to a fresh one whenever the cookie is absent, malformed, tampered with, expired, idle, or (on the store strategy) no longer present server-side.

Reports store reachability for the health indicator.