Expand description
Session-establishment middleware.
SessionMiddleware resolves or mints the per-request session: it skips
untracked paths, short-circuits detected bots into anonymous contexts,
validates an existing JWT session, and refreshes or recreates the session
when the token is stale, issuing a Set-Cookie for newly minted tokens.
Validation runs through attest_session, the same predicate the JWT and
gateway credential paths use: a cookie must name a session the server issued
to that user. An existence-only check would let a signed token borrow
another user’s live session for analytics attribution.
Copyright (c) systemprompt.io — Business Source License 1.1. See https://systemprompt.io for licensing details.