KemalIdentity::Sessions::CookieConfig
How the session cookie is named and attributed.
Validated at construction, which means an incoherent configuration is a startup crash
rather than a cookie the browser silently discards in production
(docs/01-architecture.md).
Constants
Default name, and the reason for most of the validation below.
The __Host- consequence, which is not a footnote
The prefix forbids a Domain attribute, so the cookie is scoped to exactly one host:
app.example.com and api.example.com cannot share a session. That is the right
default — it stops a compromised sibling subdomain from setting a session cookie for
the parent — but it is a wall people hit without understanding why. An application
spanning subdomains must set a non-prefixed name together with an explicit domain,
deliberately (docs/02-security-model.md).
Constructors
Instance methods
Builds the Set-Cookie for a freshly issued token.
max_age is deliberately optional. Omitting it produces a session cookie that dies
with the browser, which is the right default: the server-side row is what decides when
a session ends, and a persistent cookie only tells the browser to keep presenting a
secret the server has already stopped honouring.
Builds the Set-Cookie that clears the session cookie.
Same name, same path, same domain — a browser matches on all three, so a cleared cookie
that differs in any of them leaves the original in place. The value is emptied and
max_age is zero.
Reads the raw token out of a request's cookies, or nil if it is not there.
Takes HTTP::Cookies rather than a server context: nothing outside the Kemal layer is
allowed to know that HTTP::Server::Context exists (docs/01-architecture.md).