function SessionPlugin
Since 0.2.0
SessionPlugin(options?: SessionPluginOptions): IPlugin

Registers cookie-backed sessions under CAPABILITIES.SESSION, with optional session-backed form CSRF.

The default is a self-contained encrypted cookie: AES-256-GCM under a key derived from the secret by HKDF-SHA256, all through runtime.subtle, so there is no npm dependency and it works on Cloudflare Workers. Setting store moves the payload server-side and leaves only an opaque id in the cookie, which is what makes immediate revocation possible.

Examples

Example 1

const app = createApplication({
  plugins: [
    RuntimePlugin(),
    SessionPlugin({ secret: process.env.SESSION_SECRET, csrf: {} }),
  ],
});

Example 2

// Revocable sessions over whichever cache store is registered, with a
// rotation list: index 0 seals, both open.
SessionPlugin({
  secret: [newSecret, oldSecret],
  store: 'cache',
  mode: 'sign',
  rolling: true,
});

Parameters

optional
options: SessionPluginOptions

Session configuration

Return Type

IPlugin

The plugin

Throws

SessionSecretMissingError

During register() when no adequate secret resolves

TypeError

During register() when a numeric option is not positive

Usage

import { SessionPlugin } from "session-plugin/src/index.ts";