[det]http_set_session_options(+Options)Set options for the session library. Provided options are:
- Session timeout in seconds. Default is 600 (10 min). A timeout of
(zero) disables timeout.
- Name to use for the cookie to identify the session. Default
- Path to which the cookie is associated. Default is
/. Cookies are only sent if the HTTP request path is a
refinement of Path.
- Set the route name. Default is the unqualified hostname. To cancel
adding a route, use the empty atom. See route/1.
- Enable/disable session management. Sesion management is enabled by
default after loading this file.
- Defines when a session is created. This is one of
(default), which creates a session if there is a request whose path
matches the defined session path or
noauto, in which cases
sessions are only created by calling
- Enable/disable proxy session management. Proxy session management
associates the originating IP address of the client to the
session rather than the proxy IP address. Default is false.
- When is one of
active, which starts a thread
that performs session cleanup at close to the moment of the timeout or
which runs session GC when a new session is created.
- One of
lax (default), or
- The SameSite attribute prevents the CSRF vulnerability. strict has
best security, but prevents links from external sites from operating
properly. lax stops most CSRF attacks against REST endpoints but rarely
interferes with legitimage operations.
none removes the
samesite attribute entirely. Caution: The value
exposes the entire site to CSRF attacks.
In addition, extension libraries can define session_option/2
to make this predicate support more options. In particular,
library(http/http_redis_plugin) defines the following
- Alias name of the redis database to access. See redis_server/3.
- Prefix to use for all HTTP session related keys. Default is