Documentation on session methods/key rotation and other things

[exoup]

Howdy.
Is there any plan to write documentation on session methods and their usage?
Additionally, could session_key_rotation be explained? Unsure where this comes in.

One final question, does this library automatically handle refreshing an active session close to expiration or is that required to be handled manually? (via session.reupSession()?)

[jcs224]

Hi there, I actually just added a section for the session methods a couple days ago, tucked into the readme: https://github.com/jcs224/hono_sessions?tab=readme-ov-file#api

The session_key_rotation is recommended for when you create a session, you can switch out the key while keeping your existing session data. This is to avoid session fixation attacks. It's recommended to do this right after a successful login, for example. I should document this better, or change the API entirely, honestly:

// Within your middleware somewhere, like at the start of your successful login middleware
c.set("session_key_rotation", true)

You can learn more about session fixation here:
https://owasp.org/www-community/attacks/Session_fixation

Finally, yes, the library automatically extends the session for the length set in the expireInSeconds property. If the user is idle for beyond the expiration limit, the session becomes invalid.

[exoup]

Ah, great, thank you for the answers!

To be sure, session_key_rotation only needs to be set once?

Also one oddity I just experienced but can't seem to replicate..
I had a long-running instance of my server going and after restarting it (any number of times), my session data was no longer persisting in a request chain AT ALL.

This was using the MemoryStore in a dev environment.

I could only get functionality again with a restart of my entire system.

[jcs224]

You only need to run session_key_rotation once within a request, yes.