InMemorySessionManager
Configures the session cookie and timeout settings for in-memory sessions.
|
When you deploy multiple PingGateway servers with in-memory sessions, they don’t share the session data. You can work around this using session stickiness. But if a PingGateway server goes down for any reason, its in-memory sessions are lost. Unless the limitations of JWT-based sessions prevent it, share encrypted JWT sessions across PingGateway servers instead. Learn more in Encrypting and sharing PingGateway JWT sessions. |
Set this as the "session" in the AdminHttpApplication (admin.json) for administrative requests
and the GatewayHttpApplication (config.json ) or individual Route for other requests.
PingGateway stores the session data and sets a session cookie on the user-agent to reference the session.
Learn more about session management in PingGateway sessions.
Usage
{
"name": string,
"type": "InMemorySessionManager",
"config": {
"timeout": configuration expression<duration>,
"cookie": {
"name": configuration expression<string>,
"domain": configuration expression<string>,
"httpOnly": configuration expression<boolean>,
"path": configuration expression<string>,
"sameSite": configuration expression<enumeration>,
"secure": configuration expression<boolean>
}
}
}Properties
"timeout": configuration expression<duration>, optional-
The duration of a valid session. The cookie expires after this duration.
Default: 30 minutes
"cookie": object, optional-
The cookie used to store the reference to the session.
A cookie with default settings.
"name"configuration expression<string>, optional-
The name of the cookie stored on the user-agent. Change the default name to improve security.
Default:
IG_SESSIONID "domain"configuration expression<string>, optional-
The domain name for servers that can access the cookie.
Only set the domain if the user-agent can return cookies to servers in the domain on its next hop.
Default: The fully qualified hostname of the user-agent’s next hop.
"httpOnly": configuration expression<boolean>, optional-
Set to
trueto mitigate the risk of client-side scripts accessing protected cookies.Default:
true "path"configuration expression<string>, optional-
The URL path that must exist in the requested URL for PingGateway to use the cookie.
Default:
/
"sameSite": configuration expression<enumeration>, optional-
Options to manage the circumstances in which a cookie is sent to the server. Use one of the following values to reduce the risk of CSRF attacks:
-
STRICT: Send the cookie only if the request was initiated from the cookie domain. Not case-sensitive.Use this value to reduce the risk of cross-site request forgery (CSRF) attacks.
-
LAX: Send the cookie only with GET requests in a first-party context, where the URL in the address bar matches the cookie domain. Not case-sensitive.Use this value to reduce the risk of cross-site request forgery (CSRF) attacks.
-
NONE: Send the cookie whenever a request is made to the cookie domain. Not case-sensitive.With this setting, set
"secure": trueto prevent browsers from rejecting the cookie. Learn more in SameSite cookies.
Default:
LAX -
"secure": configuration expression<boolean>, optional-
Set to
trueto limit the scope of the cookie to secure channels.To protect the data in the cookie, set this to
trueto ensure the cookie is only sent over HTTPS. The user-agent must connect to its next hop over HTTPS.Default:
false