Sessions

Sessions

Session middleware is exported from @http-native/core/session.

import { createApp } from "@http-native/core";
import { session } from "@http-native/core/session";

const app = createApp();

app.use(session({
  secret: "your-secret-key",
}));

Request API

When session middleware is installed, the request gets:

• req.sessionId
• req.session.get(key)
• req.session.set(key, value)
• req.session.delete(key)
• req.session.has(key)
• req.session.destroy()
• req.session.isDestroyed

Example

app.get("/", (req, res) => {
  const views = Number(req.session.get("views") ?? 0) + 1;
  req.session.set("views", views);
  res.json({ views });
});

Login Flow

app.post("/login", (req, res) => {
  const body = req.json() ?? {};

  if (body.username !== "demo" || body.password !== "demo") {
    return res.status(401).json({ error: "Invalid credentials" });
  }

  req.session.set("userId", 1);
  req.session.set("loggedIn", true);
  res.json({ ok: true });
});

app.get("/profile", (req, res) => {
  if (!req.session.get("loggedIn")) {
    return res.status(401).json({ error: "Not logged in" });
  }

  res.json({ userId: req.session.get("userId") });
});

app.post("/logout", (req, res) => {
  req.session.destroy();
  res.json({ ok: true });
});

Options

• secret: string required
• maxAge?: number session TTL in seconds
• cookieName?: string default "sid"
• httpOnly?: boolean
• secure?: boolean
• sameSite?: "strict" | "lax" | "none"
• path?: string
• store?: MemoryStore | RedisStore | compatible custom store

Stores

The session module exports:

• session
• MemoryStore
• RedisStore

The default store is MemoryStore. It is in-memory and will be cleared when the process exits.