# koa-session

> Koa cookie session middleware with external store support

Latest version **7.0.2** (published 2025-01-19) · MIT license · 0 weekly downloads

## Install

```sh
npm install koa-session
pnpm add koa-session
yarn add koa-session
bun add koa-session
```

## Health

**Score 45/100 (D)** — status: maintenance-mode.

Positive: has types; esm support; no vulnerabilities; has provenance; high quality score.

Warnings: low downloads.

Negative: stale; low maintenance score.

## Facts

| | |
|---|---|
| Version | 7.0.2 |
| Published | 2025-01-19 |
| First published | 2013-11-06 |
| Weekly downloads | 0 |
| License | MIT |
| TypeScript types | bundled |
| Module format | ESM + CommonJS |
| Node | >= 18.19.0 |
| Dependencies | 3 |
| Unpacked size | 159.5 KB |
| Known vulnerabilities | 0 |
| Install scripts | no |
| Provenance | attested (GitHub Actions) |
| GitHub stars | 908 |
| Maintainers | coderhaoxin, aaron, juliangruber, eivifj, dead_horse, tjholowaychuk, jongleberry, fengmk2 |
| Keywords | koa, middleware, session, cookie |

## Links

- npm: https://www.npmjs.com/package/koa-session
- Repository: https://github.com/koajs/session
- Homepage: https://github.com/koajs/session#readme
- Issues: https://github.com/koajs/session/issues
- npm.io page: https://npm.io/package/koa-session

## Dependencies (3)

- [crc](https://npm.io/package/crc.md) ^3.8.0
- [zod](https://npm.io/package/zod.md) ^3.24.1
- [is-type-of](https://npm.io/package/is-type-of.md) ^2.2.0

## Alternatives

- [@sindresorhus/slugify](https://npm.io/package/@sindresorhus/slugify.md) — 3.7M weekly downloads
- [solid-js](https://npm.io/package/solid-js.md) — 2.7M weekly downloads
- [expo-glass-effect](https://npm.io/package/expo-glass-effect.md) — 2.5M weekly downloads
- [nanoassert](https://npm.io/package/nanoassert.md) — 780.8K weekly downloads
- [@ffmpeg/ffmpeg](https://npm.io/package/@ffmpeg/ffmpeg.md) — 529.5K weekly downloads

## Recent versions

- 7.0.2 (latest) — 2025-01-19
- 4.8.1 (latest-4) — 2018-12-18
- 2.0.1 (latest-2) — 2018-09-12
- 7.0.1 — 2025-01-19
- 7.0.0 — 2025-01-19
- 6.4.0 — 2023-02-04
- 6.3.1 — 2023-01-03
- 6.3.0 — 2023-01-03
- 6.2.0 — 2021-03-30
- 6.1.0 — 2020-10-08
- 6.0.0 — 2020-04-28
- 5.13.1 — 2020-02-01
- 5.13.0 — 2020-02-01
- 5.12.3 — 2019-08-23
- 5.12.2 — 2019-07-09
- … 43 more at https://npm.io/package/koa-session/versions

## README

# koa-session

[![NPM version][npm-image]][npm-url]
[![Node.js CI](https://github.com/koajs/session/actions/workflows/nodejs.yml/badge.svg)](https://github.com/koajs/session/actions/workflows/nodejs.yml)
[![Test coverage][codecov-image]][codecov-url]
[![Known Vulnerabilities][snyk-image]][snyk-url]
[![npm download][download-image]][download-url]
[![Node.js Version](https://img.shields.io/node/v/koajs/session.svg?style=flat)](https://nodejs.org/en/download/)
[![PRs Welcome](https://img.shields.io/badge/PRs-welcome-brightgreen.svg?style=flat-square)](https://makeapullrequest.com)

[npm-image]: https://img.shields.io/npm/v/koa-session.svg?style=flat-square
[npm-url]: https://npmjs.org/package/koa-session
[codecov-image]: https://codecov.io/gh/koajs/session/branch/master/graph/badge.svg
[codecov-url]: https://codecov.io/gh/koajs/session
[snyk-image]: https://snyk.io/test/npm/koa-session/badge.svg?style=flat-square
[snyk-url]: https://snyk.io/test/npm/koa-session
[download-image]: https://img.shields.io/npm/dm/koa-session.svg?style=flat-square
[download-url]: https://npmjs.org/package/koa-session

Simple session middleware for Koa. Defaults to cookie-based sessions and supports external stores.

## Installation

```bash
npm install koa-session
```

## Notice

7.x has a breaking change: drop Node.js < 18.19.0 support. And it support CommonJS and ESM both.

6.x changed the default cookie key from `koa:sess` to `koa.sess` to ensure `set-cookie` value valid with HTTP spec.
[See issue](https://github.com/koajs/session/issues/28).
If you want to be compatible with the previous version, you can manually set `config.key` to `koa:sess`.

## Example

View counter example:

```js
import Koa from 'koa';
import session from 'koa-session';

const app = new Koa();

app.keys = ['some secret hurr'];

const CONFIG = {
  key: 'koa.sess', /** (string) cookie key (default is koa.sess) */
  /** (number || 'session') maxAge in ms (default is 1 days) */
  /** 'session' will result in a cookie that expires when session/browser is closed */
  /** Warning: If a session cookie is stolen, this cookie will never expire */
  maxAge: 86400000,
  autoCommit: true, /** (boolean) automatically commit headers (default true) */
  overwrite: true, /** (boolean) can overwrite or not (default true) */
  httpOnly: true, /** (boolean) httpOnly or not (default true) */
  signed: true, /** (boolean) signed or not (default true) */
  rolling: false, /** (boolean) Force a session identifier cookie to be set on every response. The expiration is reset to the original maxAge, resetting the expiration countdown. (default is false) */
  renew: false, /** (boolean) renew session when session is nearly expired, so we can always keep user logged in. (default is false)*/
  secure: true, /** (boolean) secure cookie*/
  sameSite: null, /** (string) session cookie sameSite options (default null, do not provide this key if you are not restricting sameSite) */
};

app.use(session(CONFIG, app));
// or if you prefer all default config, just use => app.use(session(app));

app.use(ctx => {
  // ignore favicon
  if (ctx.path === '/favicon.ico') return;

  let n = ctx.session.views || 0;
  ctx.session.views = ++n;
  ctx.body = n + ' views';
});

app.listen(3000);
console.log('listening on port 3000');
```

## API

### Options

The cookie name is controlled by the `key` option, which defaults
to "koa.sess". All other options are passed to `ctx.cookies.get()` and
`ctx.cookies.set()` allowing you to control security, domain, path,
and signing among other settings.

#### Custom `encode/decode` Support

Use `options.encode` and `options.decode` to customize your own encode/decode methods.

### Hooks

- `valid()`: valid session value before use it
- `beforeSave()`: hook before save session

### External Session Stores

The session is stored in a cookie by default, but it has some disadvantages:

- Session is stored on client side unencrypted
- [Browser cookies always have length limits](http://browsercookielimits.squawky.net/)

  You can store the session content in external stores (Redis, MongoDB or other DBs) by passing `options.store` with three methods (these need to be async functions):

- `get(key, maxAge, { rolling, ctx })`: get session object by key
- `set(key, sess, maxAge, { rolling, changed, ctx })`: set session object for key, with a `maxAge` (in ms)
- `destroy(key, {ctx})`: destroy session for key

  Once you pass `options.store`, session storage is dependent on your external store -- you can't access the session if your external store is down. **Use external session stores only if necessary, avoid using session as a cache, keep the session lean, and store it in a cookie if possible!**

  The way of generating external session id is controlled by the `options.genid(ctx)`, which defaults to `uuid.v4()`.

  If you want to add prefix for all external session id, you can use `options.prefix`, it will not work if `options.genid(ctx)` present.

  If your session store requires data or utilities from context, `opts.ContextStore` is also supported. `ContextStore` must be a class which claims three instance methods demonstrated above. `new ContextStore(ctx)` will be executed on every request.

### Events

`koa-session` will emit event on `app` when session expired or invalid:

- `session:missed`: can't get session value from external store.
- `session:invalid`: session value is invalid.
- `session:expired`: session value is expired.

### Custom External Key

External key is used the cookie by default, but you can use `options.externalKey` to customize your own external key methods. `options.externalKey` with two methods:

- `get(ctx)`: get the external key
- `set(ctx, value)`: set the external key

### Session#isNew

Returns **true** if the session is new.

```js
if (this.session.isNew) {
  // user has not logged in
} else {
  // user has already logged in
}
```

### Session#maxAge

Get cookie's maxAge.

### Session#maxAge=

Set cookie's maxAge.

### Session#externalKey

Get session external key, only exist when external session store present.

### Session#save()

Save this session no matter whether it is populated.

### Session#manuallyCommit()

Session headers are auto committed by default. Use this if `autoCommit` is set to `false`.

### Destroying a session

To destroy a session simply set it to `null`:

```js
this.session = null;
```

## License

[MIT](LICENSE)

## Contributors

[![Contributors](https://contrib.rocks/image?repo=koajs/session)](https://github.com/koajs/session/graphs/contributors)

Made with [contributors-img](https://contrib.rocks).

---
_Source: https://npm.io/package/koa-session · Machine-readable twin of the npm.io package page. Health data is recomputed on every publish._