Struct SessionConfig 

pub struct SessionConfig {

    pub stateless: bool,
    pub cookie_refresh_cache: CookieRefreshCache,
    pub secondary_storage: Option<Arc<dyn CacheAdapter>>,
    pub store_in_database: bool,
    pub preserve_in_database: bool,
    pub additional_fields: IndexMap<String, FieldConfig>,
    pub expires_in: Duration,
    pub update_age: Option<Duration>,
    pub disable_session_refresh: bool,
    pub defer_session_refresh: bool,
    pub fresh_age: Option<Duration>,
    pub cookie_name: String,
    pub cookie_secure: bool,
    pub cookie_http_only: bool,
    pub cookie_same_site: SameSite,
    pub cookie_cache: Option<CookieCacheConfig>,
}

Session-specific configuration

Fields

stateless: bool

No durable server session authority. Session records are instance-local in memory; no SQL session rows are read or written. Captured caches remain replayable until their embedded expiry or cache version/secret invalidation.

cookie_refresh_cache: CookieRefreshCache

Stateless envelope renewal. Stateful deployments ignore this policy.

secondary_storage: Option<Arc<dyn CacheAdapter>>

Shared secondary session backend for stateful deployments.

store_in_database: bool

Also persist session rows when a secondary backend is configured.

preserve_in_database: bool

Retain ended database sessions for auditing; cache misses never fall back to them.

additional_fields: IndexMap<String, FieldConfig>

Additional fields accepted by session input and output policies.

expires_in: Duration

Session expiration duration

update_age: Option<Duration>

How often to refresh the session expiry (as a Duration).

A read refreshes when expires_at - expires_in + update_age is due. This uses the stored expiry, including application overrides, rather than the row’s last update timestamp. None refreshes on every read unless refresh is disabled or deferred.

disable_session_refresh: bool

If true, sessions are never automatically refreshed on access.

defer_session_refresh: bool

Defer refresh and expired-row deletion during GET session reads. POST /get-session performs these writes when enabled; otherwise that method is rejected with 405. Expired browser cookies are still cleared.

fresh_age: Option<Duration>

Session freshness window, defaulting to one day. None or zero skips the freshness restriction; a positive window checks creation time.

cookie_name: String

Cookie name for session token

cookie_secure: bool

Cookie settings

cookie_http_only: bool

cookie_same_site: SameSite

cookie_cache: Option<CookieCacheConfig>

Optional cookie-based session cache to avoid DB lookups.

When enabled, session data is cached in a signed/encrypted cookie. SessionManager checks the cookie cache before hitting the database.

Implementations

impl SessionConfig

pub fn stateless(self) -> Self

Select cookie-only sessions, installing the pinned no-store defaults. Configure cookie_cache afterwards to override strategy, lifetime, version, or renewal. Existing database defaults are unchanged.

pub fn has_server_session_store(&self) -> bool

Whether deployment has durable server session storage.

Trait Implementations

impl Clone for SessionConfig

fn clone(&self) -> Self

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for SessionConfig

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for SessionConfig

fn default() -> Self

Returns the “default value” for a type.