06 · Session

# config/environments/production.rb
config.assume_ssl = true      # behind a TLS-terminating load balancer
config.force_ssl  = true      # HTTPS redirect + HSTS + Secure cookies

# config/initializers/session_store.rb
Rails.application.config.session_store :cookie_store,
  key: "__Host-myapp_session", secure: true, same_site: :lax, expire_after: 30.minutes

// Express + express-session
app.set("trust proxy", 1);                 // behind a load balancer
app.use(helmet.hsts({ maxAge: 31536000 }));
app.use(session({
  secret: process.env.SESSION_SECRET,
  cookie: { secure: true, httpOnly: true, sameSite: "lax" },
  resave: false, saveUninitialized: false,
}));
app.use((req, res, next) =>              // force HTTPS
  req.secure ? next() : res.redirect(301, "https://" + req.headers.host + req.url));

# Django settings.py
SECURE_SSL_REDIRECT = True
SECURE_HSTS_SECONDS = 31536000
SESSION_COOKIE_SECURE = True
SESSION_COOKIE_HTTPONLY = True
SESSION_COOKIE_SAMESITE = "Lax"
CSRF_COOKIE_SECURE = True

# Flask equivalent
app.config.update(SESSION_COOKIE_SECURE=True,
                  SESSION_COOKIE_HTTPONLY=True,
                  SESSION_COOKIE_SAMESITE="Lax")

# config/initializers/cookie_rotator.rb (Rails guide example)
# Move signed cookies from SHA1 to SHA256 without logging anyone out:
# new cookies use SHA256, old SHA1 cookies still work and get upgraded
Rails.application.config.action_dispatch.signed_cookie_digest = "SHA256"
Rails.application.config.action_dispatch.cookies_rotations.tap do |cookies|
  cookies.rotate :signed, digest: "SHA1"
end
# the same rotate call can also accept cookies made with an old secret

// first secret signs new cookies; the rest are only accepted for verification
app.use(session({ secret: [process.env.SESSION_SECRET_2025, process.env.SESSION_SECRET_2024] }));

# Django 4.1+: new key signs, fallbacks still verify
SECRET_KEY = os.environ["SECRET_KEY_2025"]
SECRET_KEY_FALLBACKS = [os.environ["SECRET_KEY_2024"]]

def create
  if user = User.authenticate_by(params.permit(:email_address, :password))
    cart = session[:cart]                 # keep what you need
    reset_session                         # new session id, old one discarded
    session[:user_id] = user.id
    session[:cart] = cart
    redirect_to root_path
  end
end
# Devise/Warden and the Rails 8 generator already do this on sign-in

app.post("/login", async (req, res, next) => {
  const user = await verifyCredentials(req.body);
  if (!user) return res.status(401).send("Invalid email or password.");
  const cart = req.session.cart;              // keep what you need
  req.session.regenerate(err => {             // new ID, old one destroyed
    if (err) return next(err);
    req.session.userId = user.id;
    req.session.cart = cart;
    res.redirect("/");
  });
});

# Django: auth.login() rotates the session key for you
from django.contrib.auth import login
login(request, user)            # calls request.session.cycle_key()

# Flask: there is no session ID with the default cookie store, but with
# a server-side store (Flask-Session) clear and rebuild on login:
cart = session.get("cart")
session.clear()
session["user_id"] = user.id
session["cart"] = cart