class KvSessionStore
implements ISessionStore
Since 0.2.0

A session store backed by Workers KV.

Constructed by the application and handed to SessionPlugin, not registered by CloudflarePlugin: SessionPluginOptions.store is read when the plugin is constructed, which is before any application exists, so a store published in the service registry could never reach it.

KV's eventual consistency applies. A destroy() propagates within seconds rather than instantly, which is still strictly better than the cookie strategy, where a stolen cookie stays valid until maxAge.

Examples

Example 1

import { env } from 'cloudflare:workers';
import { createRuntimeServices } from '@setu-ts/runtime';
import { KvSessionStore } from '@setu-ts/cloudflare-plugin';

const runtime = createRuntimeServices({ env });

app.register(SessionPlugin({
  secret: String(env.SESSION_SECRET),
  mode: 'sign',
  store: new KvSessionStore(env.SESSIONS as IKvNamespace, runtime),
}));

Constructors

KvSessionStore(
clock: CacheClock,
)
Parameters

The KV namespace binding

clock: CacheClock

Wall clock; pass IRuntimeServices

optional
options: KvSessionStoreOptions

Key prefix

Methods

destroy(id: string): Promise<boolean>

Removes a stored session.

read(id: string): Promise<SessionData | null>

Reads a stored session payload.

write(
id: string,
data: SessionData,
ttlMs: number
): Promise<void>

Writes a session payload, replacing any existing one.

Usage

import { KvSessionStore } from "cloudflare-plugin/src/index.ts";