Struct SessionConfig 

pub struct SessionConfig {
    pub ttl: Duration,
    pub cookie_name: Arc<str>,
    pub secure: bool,
    pub same_site: SameSite,
    pub http_only: bool,
    pub path: Arc<str>,
    pub max_custom_bytes: usize,
}

Session configuration controlling cookie attributes and session lifetime.

Use SessionConfig::builder() for ergonomic construction, or SessionConfig::default() for production-safe defaults.

Fields

ttl: Duration

Session time-to-live in the store and Max-Age on the cookie.

cookie_name: Arc<str>

Cookie name (default: "axess.sid").

Prefer the __Host- prefix in production (e.g., "__Host-axess.sid"). Browsers refuse to set a __Host- cookie unless Secure=true, Path="/", and the cookie has no Domain attribute: together these prevent subdomain-scoped overwrites and cross-host injection that the bare name does not. Using the prefix without Secure=true panics in build() to fail fast on misconfiguration. The __Secure- prefix is similar but only requires Secure=true.

secure: bool

Set the Secure flag on the cookie (default: true).

Set to false for local HTTP development.

same_site: SameSite

SameSite policy (default: Lax).

Lax is the right default for axess: the OAuth/OIDC callback flow depends on the cookie being delivered on the IdP’s top-level GET redirect back to the application, which Strict would strip. Lax still blocks the cookie from cross-site sub-resource requests (<img>, <iframe>, fetch() without credentials), but does deliver the cookie on top-level navigations from a third-party origin. Applications MUST therefore layer their own CSRF defence on every state-changing POST/PUT/DELETE; the bundled axess_core::middleware::csrf middleware does this, but it is opt-in.

http_only: bool

Set the HttpOnly flag on the cookie (default: true).

path: Arc<str>

Cookie Path attribute (default: "/").

max_custom_bytes: usize

Maximum size (in bytes) of serialized custom session data (default: 64 KiB).

Prevents session-bloat DoS where an attacker inflates the custom JSON bag to exhaust storage. Set to 0 to disable the limit.

Implementations

impl SessionConfig

pub fn builder() -> SessionConfigBuilder

Create a SessionConfigBuilder with production-safe defaults.

Trait Implementations

impl Clone for SessionConfig

fn clone(&self) -> SessionConfig

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for SessionConfig

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for SessionConfig

fn default() -> Self

Returns the “default value” for a type.