Sessions

node ace add @adonisjs/session

# Skip the prompt
node ace add @adonisjs/session --store=redis

import env from '#start/env'
import app from '@adonisjs/core/services/app'
import { defineConfig, stores } from '@adonisjs/session'

export default defineConfig({
  enabled: true,
  cookieName: 'adonis-session',
  clearWithBrowser: false,
  age: '2h',

  cookie: {
    path: '/',
    httpOnly: true,
    secure: app.inProduction,
    sameSite: 'lax',
  },

  store: env.get('SESSION_DRIVER'),

  stores: {
    cookie: stores.cookie(),

    file: stores.file({
      location: app.tmpPath('sessions')
    }),

    redis: stores.redis({
      connection: 'main'
    }),

    database: stores.database({
      connectionName: 'pg',
      tableName: 'sessions',
    }),

    dynamodb: stores.dynamodb({
      clientConfig: {
        region: env.get('AWS_REGION'),
        endpoint: env.get('AWS_ENDPOINT'),
      },
      tableName: 'sessions',
    }),
  }
})

node ace add @adonisjs/redis

npm install @aws-sdk/client-dynamodb

import router from '@adonisjs/core/services/router'
import Product from '#models/product'

/**
 * Display items in the cart.
 * Uses get() with a default value of empty array.
 */
router.get('/cart', ({ session }) => {
  const cartItems = session.get('cart', [])
  return { items: cartItems, total: cartItems.length }
})

/**
 * Add a product to the cart.
 * Demonstrates put() to store updated cart data.
 */
router.post('/cart', async ({ request, session }) => {
  const productId = request.input('product_id')
  const product = await Product.findOrFail(productId)
  
  const cartItems = session.get('cart', [])
  cartItems.push({ 
    id: product.id, 
    name: product.name, 
    quantity: 1 
  })
  
  session.put('cart', cartItems)
  return { message: 'Item added', totalItems: cartItems.length }
})

/**
 * Remove a specific item from the cart.
 * Shows how to update and store modified data.
 */
router.delete('/cart/:productId', ({ params, session }) => {
  const cartItems = session.get('cart', [])
  const updatedCart = cartItems.filter(item => item.id !== params.productId)
  
  session.put('cart', updatedCart)
  return { message: 'Item removed' }
})

/**
 * Clear the entire cart.
 * Uses forget() to remove a specific key.
 */
router.delete('/cart', ({ session }) => {
  session.forget('cart')
  return { message: 'Cart cleared' }
})

router.get('/checkout', ({ session, response }) => {
  /**
   * Check if cart exists and has items before proceeding.
   * The has() method returns true if the key exists.
   */
  if (!session.has('cart')) {
    return response.redirect('/cart')
  }
  
  const cartItems = session.get('cart')
  return { items: cartItems }
})

router.post('/process-payment', ({ session }) => {
  /**
   * Get the cart data and remove it in one operation.
   * This is useful when processing one-time data.
   */
  const cartItems = session.pull('cart', [])
  
  // Process payment with cartItems
  // Cart is now automatically removed from session
  
  return { processed: cartItems.length }
})

router.post('/visit', ({ session }) => {
  /**
   * Increment visit counter by 1.
   * If 'visits' doesn't exist, it's initialized to 1.
   */
  session.increment('visits')
  
  const totalVisits = session.get('visits')
  return { visits: totalVisits }
})

router.post('/undo', ({ session }) => {
  /**
   * Decrement a counter.
   * If 'actions' doesn't exist, it's initialized to -1.
   */
  session.decrement('actions')
  
  return { actionsRemaining: session.get('actions', 0) }
})

router.get('/debug/session', ({ session }) => {
  /**
   * Returns all session data as an object.
   * Useful for debugging or displaying session state.
   */
  const allData = session.all()
  return allData
})

router.post('/logout', ({ session, auth, response }) => {
  // Clear authentication
  await auth.logout()
  
  /**
   * Remove all session data.
   * This is useful during logout to clean up all user state.
   */
  session.clear()
  
  return response.redirect('/login')
})

router.post('/cart', async ({ session, response }) => {
  // Add item to cart...
  
  /**
   * Flash a success message for the next request.
   * Available via flashMessages.get('success') in templates.
   */
  session.flash('success', 'Item added to the cart')
  
  return response.redirect().back()
})

export default class OrdersController {
  async store({ session, response }: HttpContext) {
    try {
      // Process order...
      session.flash('success', 'Order placed successfully!')
      return response.redirect('/orders')
    } catch (error) {
      session.flash('error', 'Payment failed. Please try again.')
      return response.redirect().back()
    }
  }
}

@if(flashMessages.has('success'))
  <div class="alert alert-success">
    {{ flashMessages.get('success') }}
  </div>
@end

@if(flashMessages.has('error'))
  <div class="alert alert-error">
    {{ flashMessages.get('error') }}
  </div>
@end

router.post('/newsletter/subscribe', ({ session, response }) => {
  // Subscribe user...
  
  session.flash('newsletter', 'Check your email to confirm subscription')
  return response.redirect().back()
})

@if(flashMessages.has('newsletter'))
  <div class="alert alert-newsletter">
    {{ flashMessages.get('newsletter') }}
  </div>
@end

export default class PostsController {
  async store({ request, session, response }: HttpContext) {
    try {
      // Attempt to create post...
      throw new Error('Unable to publish post')
    } catch (error) {
      /**
       * Flash form data to repopulate the form.
       * Users won't have to re-enter their data.
       */
      session.flashAll()
      session.flash('error', 'Failed to create post. Please try again.')
      
      return response.redirect().back()
    }
  }
}

// Flash only specific fields
session.flashOnly(['title', 'content', 'category'])

// Flash everything except sensitive fields
session.flashExcept(['password', 'credit_card'])

<input type="text" name="title" value="{{ old('title') }}" />
<textarea name="content">{{ old('content') }}</textarea>

export default class CheckSubscriptionMiddleware {
  async handle({ auth, session, response }: HttpContext, next: NextFn) {
    const user = auth.getUserOrFail()
    
    if (!user.hasActiveSubscription) {
      /**
       * Keep all flash messages for one more request.
       */
      session.reflash()
      session.flash('error', 'Please subscribe to continue')
      
      return response.redirect('/subscribe')
    }
    
    await next()
  }
}

// Re-flash only error messages
session.reflashOnly(['error'])

// Re-flash all messages except success
session.reflashExcept(['success'])

import type { HttpContext } from '@adonisjs/core/http'

export default class SessionController {
  async show({ request, session, view }: HttpContext) {
    /**
     * If the login page is accessed with an ?intended query param,
     * store the intended URL in the session for use after login
     */
    const intended = request.input('intended')
    if (intended) {
      session.setIntendedUrl(intended)
    }

    return view.render('auth/login')
  }

  async store({ request, auth, response }: HttpContext) {
    const user = await User.verifyCredentials(
      request.input('email'),
      request.input('password')
    )
    await auth.use('web').login(user)

    /**
     * Redirect to the intended URL if one was stored,
     * otherwise fall back to dashboard
     */
    return response.redirect().toIntendedRoute('dashboard')
  }
}

import router from '@adonisjs/core/services/router'

router.get('/example', ({ session }) => {
  /**
   * Read without consuming
   */
  const url = session.getIntendedUrl()

  /**
   * Read and remove in one step
   */
  const consumed = session.pullIntendedUrl()

  /**
   * Remove without reading
   */
  session.clearIntendedUrl()
})

export default class AuthController {
  async login({ request, session, response }: HttpContext) {
    const { email, password } = request.only(['email', 'password'])
    
    // Verify credentials...
    const user = await User.verifyCredentials(email, password)
    
    /**
     * Generate a new session ID while preserving data.
     * This prevents session fixation attacks.
     */
    await session.regenerate()
    
    // Store user info in the new session
    session.put('user_id', user.id)
    
    return response.redirect('/dashboard')
  }
}

import type { HttpContext } from '@adonisjs/core/http'

export default class SessionController {
  async destroy({ auth, session, response }: HttpContext) {
    await auth.use('web').logout()

    /**
     * Move the remaining data to a new session ID and destroy
     * the old session, so a slow request cannot restore it
     */
    session.regenerate() 

    session.flash('success', 'You have been logged out')
    return response.redirect('/login')
  }
}

import env from '#start/env'
import app from '@adonisjs/core/services/app'
import { defineConfig, stores } from '@adonisjs/session'

export default defineConfig({
  enabled: true,
  cookieName: 'adonis-session',
  age: '2h',
  clearWithBrowser: true, 
  refreshCookie: false, 
  renewMissingSessionId: true, 

  cookie: {
    path: '/',
    httpOnly: true,
    secure: app.inProduction,
    sameSite: 'lax',
  },

  store: env.get('SESSION_DRIVER'),

  stores: {
    redis: stores.redis({
      connection: 'main',
      encrypt: true, 
    }),
  },
})

import {
  SessionData,
  SessionStoreFactory,
  SessionStoreContract,
} from '@adonisjs/session/types'

/**
 * The config you want to accept
 */
export type MongoDbConfig = {
  collection: string;
  database: string
}

/**
 * The MongoDbStore class handles the actual storage operations.
 * It implements the four required methods: read, write, destroy, and touch.
 */
export class MongoDbStore implements SessionStoreContract {
  constructor(protected config: MongoDbConfig) {}

  /**
   * Read session data for a given session ID.
   * Return null if the session doesn't exist.
   */
  async read(sessionId: string): Promise<SessionData | null> {
    // Query your storage and return session data
  }

  /**
   * Write session data for a given session ID.
   */
  async write(sessionId: string, data: SessionData): Promise<void> {
    // Save session data to your storage
  }

  /**
   * Delete session data for a given session ID.
   */
  async destroy(sessionId: string): Promise<void> {
    // Remove session from your storage
  }

  /**
   * Update the session's expiration time without changing data.
   */
  async touch(sessionId: string): Promise<void> {
    // Extend the expiration timestamp in your storage
  }
}

/**
 * The factory function accepts configuration and returns a driver
 * function. The driver function creates a new instance of the store
 * class when called by the session manager.
 */
export function mongoDbStore(config: MongoDbConfig): SessionStoreFactory {
  return (ctx, sessionConfig) => {
    return new MongoDbStore(config)
  }
}

import { defineConfig } from '@adonisjs/session'
import { mongoDbStore } from '#session_stores/mongodb_store'

export default defineConfig({
  store: env.get('SESSION_DRIVER'),
  
  stores: {
    mongodb: mongoDbStore({
      collection: 'sessions',
      database: 'myapp'
    })
  }
})

SESSION_DRIVER=mongodb