Back

Sessions

Server-side, in-memory sessions with TTL configurable via SESSION_TTL. The kyrux_session cookie is HttpOnly, SameSite=Strict, and Secure in production — the Secure flag is applied automatically by bootstrap when APP_ENV=production, including behind a reverse proxy (nginx/Caddy).

⚠️ In-memory state: sessions (and JWT revocations) live in the process. Restarting/redeploying logs out every user, and multiple replicas behind a load balancer don't share sessions — in that scenario, use sticky sessions on the balancer until an external backend (e.g. Redis) is available.

Direct session API

Use this when you need full control over what's stored in the session. Use Get/Set/Delete — they're safe for concurrent requests on the same session:

import "kyrux/core/security/session"

// Create a session manually
sess, err := fw.Sessions.New()
sess.Set("chave", valor)
session.SetCookie(ctx.Writer, sess.ID, ctx.Request.TLS != nil)

// Read the session from the request
sess, ok := session.FromRequest(ctx.Request, fw.Sessions)

// Read a value
val, ok := sess.Get("chave")

// Remove the session
fw.Sessions.Delete(sess.ID)

For authentication with auth.User, use auth.Login and auth.Logout — see section 15. Authentication.