Struct SessionConfig 

pub struct SessionConfig { /* private fields */ }

How sessions are issued, kept and expired.

The defaults follow the security notes in docs/plans/SESSIONS_CSRF.md: a __Host-session cookie that is HttpOnly, Secure, Path=/ with no Domain and SameSite=Lax, a 30 minute idle timeout, a 12 hour absolute lifetime and a 2 second bound on every store call.

Implementations

impl SessionConfig

pub fn new() -> Self

The default configuration (see the type docs).

pub fn cookie_name(self, name: impl Into<String>) -> Self

Set the cookie name.

A name starting with __Host- or __Secure- makes browsers insist on Secure, so it cannot be combined with insecure_development.

pub fn same_site(self, same_site: SameSite) -> Self

Set SameSite: Lax (default), Strict, or None.

None sends the cookie on every cross-site request, so it is only accepted together with csrf_key and Secure, and the layer then requires a valid CSRF token header on every unsafe request that carries a live session.

pub fn idle_timeout(self, idle: Duration) -> Self

Expire a session this long after its last use (default 30 min).

The last use is recorded at most once per write_interval, so a session can expire up to one interval early, never late.

pub fn absolute_lifetime(self, absolute: Duration) -> Self

Expire a session this long after login (default 12 h), however active it is. Rotation does not extend it; login restarts it.

pub fn write_interval(self, interval: Duration) -> Self

Write the idle timestamp at most this often (default a quarter of the idle timeout), so reads do not become writes.

pub fn store_timeout(self, timeout: Duration) -> Self

Bound every store call (default 2 s). A call that does not finish fails like any other store error.

pub fn insecure_development(self) -> Self

Plain-HTTP development: drop Secure and the __Host- or __Secure- prefix of the cookie name.

This is always explicit; it is never inferred from the request. Never enable it in production.

pub fn csrf_key(self, key: impl Into<Vec<u8>>) -> Self

Key for CSRF tokens (at least 32 random bytes, kept secret).

Without a key Session::csrf_token returns None.

pub fn csrf_header(self, name: impl Into<String>) -> Self

Request header carrying the CSRF token when SameSite=None requires the layer to check it (default x-csrf-token).

pub fn name(&self) -> &str

The cookie name.

pub fn validate(&self) -> Result<(), SessionConfigError>

Check the configuration.

Errors

SessionConfigError for an invalid cookie name, a prefixed name without Secure, SameSite=None without Secure and a CSRF key, a short key, an invalid header name, or a zero duration.

Trait Implementations

impl Clone for SessionConfig

fn clone(&self) -> SessionConfig

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for SessionConfig

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for SessionConfig

fn default() -> Self

Returns the “default value” for a type.