core options fields

10 notes, read out of this brain and free to use. Each one was extracted from a source and is re-checked against its exam.

Session expiration configuration

Session expiration can be configured by passing a session object to the auth configuration. The expiresIn parameter sets the session lifetime in seconds (default: 60 * 60 * 24 * 7 for 7 days). The updateAge parameter controls how often session expiration is refreshed in seconds (default: 60 * 60 * 24 for 1 day).

Disable session refresh option

Session refresh can be disabled by setting disableSessionRefresh: true in the session configuration. When disabled, the session is not updated regardless of the updateAge option value.

Defer session refresh option

By default, GET /get-session performs database writes to refresh the session. This can cause issues with read-replica setups where GET requests are routed to read-only replicas. When deferSessionRefresh: true is enabled, GET becomes read-only and returns needsRefresh: true when refresh is needed. The client automatically calls POST to perform the refresh.

Configure freshAge for session freshness

The freshAge value can be customized by passing a session object in the auth configuration. freshAge is specified in seconds. To disable the freshness check entirely, set freshAge to 0.

Enable cookie cache configuration

Cookie caching is enabled by setting session.cookieCache in the auth config with enabled: true and maxAge in seconds. Example: session: { cookieCache: { enabled: true, maxAge: 5 * 60 } }

Set cookie cache strategy configuration

Cookie cache strategy is configured by setting the strategy property in the cookieCache configuration. Example: session: { cookieCache: { enabled: true, maxAge: 5 * 60, strategy: "compact" } } where strategy can be "compact", "jwt", or "jwe".

Store sessions in database with secondary storage

Even when secondary storage is provided, you can choose to store sessions in the database instead by passing storeSessionInDatabase: true in the session configuration. Example: session: { storeSessionInDatabase: true }

Preserve sessions configuration

To preserve sessions when revoked, set preserveSessionInDatabase: true in the session configuration when using secondary storage. Example: session: { preserveSessionInDatabase: true }

refreshCache option for stateless sessions

The refreshCache option controls automatic cookie refresh before expiry without querying any database. refreshCache: false (default) means no automatic refresh—when the cookie cache expires, it attempts to fetch from the database if available. refreshCache: true enables automatic refresh with default settings, refreshing when 80% of maxAge is reached (20% time remaining). refreshCache can also be an object with updateAge property for custom refresh configuration.

maximumSessions option for multi-session plugin

The multi-session plugin accepts a maximumSessions option to specify the maximum number of sessions a user can have. By default, the plugin allows 5 sessions per device. This can be configured by passing maximumSessions as an option to the multiSession() function.

Give your agent this brain