---
title: InMemorySessionManager
description: Configure InMemorySessionManager to manage in-memory session storage, cookie settings, and session timeouts in PingGateway.
component: pinggateway
version: 2026
page_id: pinggateway:reference:InMemorySessionManager
canonical_url: https://docs.pingidentity.com/pinggateway/2026/reference/InMemorySessionManager.html
llms_txt: https://docs.pingidentity.com/pinggateway/llms.txt
docs_for_agents: https://developer.pingidentity.com/build-with-ai/docs-for-agents.md
revdate: 2026-09-15T09:35:50Z
section_ids:
  usage: Usage
  properties: Properties
  more_information: More information
---

# InMemorySessionManager

Configures the session cookie and timeout settings for in-memory sessions.

|   |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                |
| - | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
|   | When you deploy multiple PingGateway servers with in-memory sessions, they don't share the session data.You can work around this using [session stickiness](../about/about-sessions.html#session-stickiness). But if a PingGateway server goes down for any reason, its in-memory sessions are lost.Unless the limitations of [JWT-based sessions](../about/about-sessions.html#sessions-jwt-based) prevent it, share encrypted JWT sessions across PingGateway servers instead. Learn more in [Encrypting and sharing PingGateway JWT sessions](../installation-guide/jwtsession-using.html). |

Set this as the `"session"` in the [AdminHttpApplication (`admin.json`)](AdminHttpApplication.html) for administrative requests and the [GatewayHttpApplication (`config.json` )](GatewayHttpApplication.html) or individual [Route](Route.html) for other requests. PingGateway stores the session data and sets a session cookie on the user-agent to reference the session.

Learn more about session management in [PingGateway sessions](../about/about-sessions.html).

## Usage

```none
{
  "name": string,
  "type": "InMemorySessionManager",
  "config": {
    "timeout": configuration expression<duration>,
    "cookie": {
      "name": configuration expression<string>,
      "domain": configuration expression<string>,
      "httpOnly": configuration expression<boolean>,
      "path": configuration expression<string>,
      "sameSite": configuration expression<enumeration>,
      "secure": configuration expression<boolean>
    }
  }
}
```

## Properties

* `"timeout"`: *configuration expression<[duration](preface.html#definition-duration)>, optional*

  The duration of a valid session. The cookie expires after this duration.

  Default: 30 minutes

* `"cookie"`: *[object](preface.html#definition-object), optional*

  The cookie used to store the reference to the session.

  A cookie with default settings.

  * `"name"` *configuration expression<[string](preface.html#definition-string)>, optional*

    The name of the cookie stored on the user-agent. Change the default name to improve security.

    Default: `IG_SESSIONID`

  * `"domain"` *configuration expression<[string](preface.html#definition-string)>, optional*

    The domain name for servers that can access the cookie.

    Only set the domain if the user-agent can return cookies to servers in the domain on its next hop.

    Default: The fully qualified hostname of the user-agent's next hop.

  * `"httpOnly"`: *configuration expression<[boolean](preface.html#definition-boolean)>, optional*

    Set to `true` to mitigate the risk of client-side scripts accessing protected cookies.

    Default: `true`

  * `"path"` *configuration expression<[string](preface.html#definition-string)>, optional*

    The URL path that must exist in the requested URL for PingGateway to use the cookie.

    Default: `/`

  - `"sameSite"`: *configuration expression<[enumeration](preface.html#definition-enumeration)>, optional*

    Options to manage the circumstances in which a cookie is sent to the server. Use one of the following values to reduce the risk of CSRF attacks:

    * `STRICT`: Send the cookie only if the request was initiated from the cookie domain. Not case-sensitive.

      Use this value to reduce the risk of cross-site request forgery (CSRF) attacks.

    * `LAX`: Send the cookie only with GET requests in a first-party context, where the URL in the address bar matches the cookie domain. Not case-sensitive.

      Use this value to reduce the risk of cross-site request forgery (CSRF) attacks.

    * `NONE`: Send the cookie whenever a request is made to the cookie domain. Not case-sensitive.

      With this setting, set `"secure": true` to prevent browsers from rejecting the cookie. Learn more in [SameSite cookies](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite).

    Default: `LAX`

  - `"secure"`: *configuration expression<[boolean](preface.html#definition-boolean)>, optional*

    Set to `true` to limit the scope of the cookie to secure channels.

    To protect the data in the cookie, set this to `true` to ensure the cookie is only sent over HTTPS. The user-agent must connect to its next hop over HTTPS.

    Default: `false`

## More information

[org.forgerock.openig.session.cookie.InMemorySessionManagerHeaplet](../_attachments/apidocs/org/forgerock/openig/session/cookie/InMemorySessionManagerHeaplet.html)