You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
This repository was archived by the owner on Dec 12, 2023. It is now read-only.
Copy file name to clipboardExpand all lines: README.md
+29-28Lines changed: 29 additions & 28 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -59,7 +59,7 @@ The `nuxt-session` library provide many helpers to interact with the session fro
59
59
- `DELETE /api/session`: Delete the current session
60
60
- `POST /api/session`: Overwrite the current session data
61
61
- `PATCH /api/session`: Add to the current session data
62
-
- ✔️ Storage via [unjs/unstorage](https://github.com/unjs/unstorage) - use memory, redis, fs, cloudflare-kv, ... to store your session data
62
+
- ✔️ Storage via [unjs/unstorage](https://github.com/unjs/unstorage) - use memory, redis, fs, cloudflare-kv, ... drivers to store your session data
63
63
- ✔️ Automatic session and storage cleanup on expiry
64
64
65
65
Use the module-playground (see playground below) to play around with the module. Read the [documentation](#documentation) if you want to learn about the library without starting your local environment.
@@ -98,10 +98,13 @@ We call this "stay" that lasts as long as the above criteria are met a session.
2. [How to configure session-storage](#storage-backends)
103
-
3. [Configuration](#configuration)
103
+
2. [Configuration](#configuration)
104
+
3. [Storage Drivers](#storage-drivers)
105
+
- [Example of using a different storage driver](#example-of-using-a-different-storage-driver)
104
106
4. [Security](#security)
107
+
5. [Development](#development)
105
108
106
109
### Session Data
107
110
@@ -193,14 +196,6 @@ declare interface Session {
193
196
194
197
In theory you can manipulate this data on the server side if you want to. If you do this, the session will likely become invalid in the process, so proceed at your own risk!
195
198
196
-
### Storage Backends
197
-
198
-
`nuxt-session` allows you to use different storage backends. A storage backend is something like your server memory, a redis database, the file-system of your server, ... Supporting these backend is possible by using [unjs/unstorage](https://github.com/unjs/unstorage) for storage management. This library connects to the different backends it supports with a unified interface.
199
-
200
-
You can configure the storage backend using the `session.session.storageOptions` configuration option of the `nuxt-session` module. By default `memory` is used to store the sessions. This has some advantages like speed and easy setup, but some disadvantages like missing persistency (if your server crashes, the sessions are gone!) and possible exploits like setting millions of sessions trying to exhaust your server-memory or saving large amounts of data into the session that your server cannot handle.
201
-
202
-
Check out here what storage backends are supported and how to configure them: https://github.com/unjs/unstorage#drivers
203
-
204
199
### Configuration
205
200
206
201
Here's what the full _default_ module configuration looks like:
@@ -238,26 +233,32 @@ Here's what the full _default_ module configuration looks like:
238
233
}
239
234
```
240
235
241
-
```
242
-
#### Using a different storage driver
236
+
### Storage Drivers
237
+
238
+
`nuxt-session` allows you to use different storage drivers. A storage driver is something like your server memory, a redis database, the file-system of your server, ... Supporting these drivers is possible by using [unjs/unstorage](https://github.com/unjs/unstorage) for storage management. This library connects to the different drivers it supports with a unified interface.
239
+
240
+
You can configure the storage driver using the `session.session.storageOptions` configuration option of the `nuxt-session` module. By default `memory` is used to store the sessions. This has some advantages like speed and easy setup, but some disadvantages like missing persistency (if your server crashes, the sessions are gone!) and possible exploits like setting millions of sessions trying to exhaust your server-memory or saving large amounts of data into the session that your server cannot handle.
241
+
242
+
Check out here what storage drivers are supported and how to configure them: https://github.com/unjs/unstorage#drivers
243
243
244
-
You can use any stroage driver supported by unstorage. For example, this will use the redis driver instead of the default memory driver.
244
+
#### Example of using a different storage driver
245
+
246
+
You can use any storage driver supported by [unjs/unstorage](https://github.com/unjs/unstorage). For example, here is how you can configure the module to use the `redis` driver:
245
247
```ts
246
-
//nuxt.config.ts
247
-
{
248
-
...,
248
+
// file:~/nuxt.config.ts
249
+
export default defineNuxtConfig({
250
+
modules: ['@sidebase/nuxt-session'],
251
+
session: {
249
252
session: {
250
-
session:{
251
-
storageOptions:{
252
-
driver: 'redis',
253
-
options: {
254
-
url: 'redis://localhost:6379'
255
-
}
256
-
}
253
+
storageOptions: {
254
+
driver: 'redis',
255
+
options: {
256
+
url: 'redis://localhost:6379'
257
257
}
258
+
}
258
259
}
259
-
}
260
-
260
+
}
261
+
})
261
262
```
262
263
263
264
### Security
@@ -277,7 +278,7 @@ Without further ado, here's some attack cases you can consider and take action a
277
278
- problems: Denial-of-Service by server-ressource exhaustion (bandwidth, cpu, memory)
278
279
- possible mitigations:
279
280
- add authentication and possibly authorization to your app
280
-
- use `redis` as a storage backend and set data to expire automatically
281
+
- use `redis` as a storage driver and set data to expire automatically
281
282
3. guessing correct session ids
282
283
- problems: session data can leak
283
284
- possible mitigations:
@@ -293,7 +294,7 @@ Without further ado, here's some attack cases you can consider and take action a
293
294
294
295
A last reminder: This library was not written by crypto- or security-experts. So please proceed at your own risk, inspect the code if you want to and open issues / pull requests where you see room for improvement. If you want to file a security-concern privately, please send an email to `support@sidestream.tech` with the subject saying "SECURITY nuxt-session" and we'll look into your request ASAP.
295
296
296
-
## Development
297
+
### Development
297
298
298
299
- Run `npm run dev:prepare` to generate type stubs.
299
300
- Use `npm run dev` to start [the module playground](./playground) in development mode.
0 commit comments