Function SessionPlugin

SessionPlugin(options?: SessionPluginOptions): IPlugin
Registers cookie-backed sessions under CAPABILITIES.SESSION, with optional session-backed form CSRF.

The default is a self-contained encrypted cookie: AES-256-GCM under a key derived from the secret by HKDF-SHA256, all through runtime.subtle, so there is no npm dependency and it works on Cloudflare Workers. Setting store moves the payload server-side and leaves only an opaque id in the cookie, which is what makes immediate revocation possible.
Parameters
- options: SessionPluginOptions = {}
  Session configuration
Returns IPlugin
The plugin
Throws
During register() when no adequate secret resolves

Throws
During register() when a numeric option is not positive
Example
```
const app = createApplication({
  plugins: [
    RuntimePlugin(),
    SessionPlugin({ secret: process.env.SESSION_SECRET, csrf: {} }),
  ],
});
```
Example
```
// Revocable sessions over whichever cache store is registered, with a
// rotation list: index 0 seals, both open.
SessionPlugin({
  secret: [newSecret, oldSecret],
  store: 'cache',
  mode: 'sign',
  rolling: true,
});
```
Since
0.2.0
- Defined in packages/session-plugin/src/plugin/session-plugin.ts:76