Set options for the session library. Provided options are:
- Session timeout in seconds. Default is 600 (10 min).
A timeout of
0 (zero) disables timeout.
- Name to use for the cookie to identify the session.
- Path to which the cookie is associated. Default is
/. Cookies are only sent if the HTTP request path
is a refinement of Path.
- Set the route name. Default is the unqualified
hostname. To cancel adding a route, use the empty
atom. See route/1.
- Enable/disable session management. Sesion management
is enabled by default after loading this file.
- Defines when a session is created. This is one of
(default), which creates a session if there is a request
whose path matches the defined session path or
in which cases sessions are only created by calling
- Enable/disable proxy session management. Proxy session
management associates the originating IP address of
the client to the session rather than the proxy IP
address. Default is false.
- When is one of
active, which starts a thread that
performs session cleanup at close to the moment of the
passive, which runs session GC when a new
session is created.
- One of
lax (default), or
strict - The
SameSite attribute prevents the CSRF vulnerability.
strict has best security, but prevents links from
external sites from operating properly. lax stops most
CSRF attacks against REST endpoints but rarely interferes
with legitimage operations.
none removes the samesite
attribute entirely. Caution: The value
none exposes the
entire site to CSRF attacks.
In addition, extension libraries can define session_option/2 to make
this predicate support more options. In particular,
library(http/http_redis_plugin) defines the following additional
- Alias name of the redis database to access. See redis_server/3.
- Prefix to use for all HTTP session related keys. Default is