mcpField
S
session-management

session-management

github.com/secondskySecurity240416 installsUpdated 5w ago
Repository

About session-management

A skill for developers implementing secure application sessions. It covers JWT access and refresh tokens, Redis storage, cookie settings, and session security practices.

Key features

  1. 01JWT access and refresh tokens
  2. 02Redis session storage example
  3. 03Secure cookie configuration
  4. 04Token refresh flow
  5. 05Session security requirements and anti-patterns

Use cases

  1. 01Implement token-based sessions in a web app
  2. 02Store session data in Redis
  3. 03Set cookie security and token expiration

Install

Copy the command and run it in a terminal.

$npx skills add https://github.com/secondsky/claude-skills --skill session-management

After installing, type/session-managementin Claude Code to confirm it loaded.

Details

From the project README

Session Management

Implement secure session management with proper token handling and storage.

Token-Based Sessions

const jwt = require('jsonwebtoken');

function generateTokens(user) {
  const accessToken = jwt.sign(
    { userId: user.id, role: user.role, type: 'access' },
    process.env.JWT_SECRET,
    { expiresIn: '1h' }
  );

  const refreshToken = jwt.sign(
    { userId: user.id, type: 'refresh' },
    process.env.REFRESH_SECRET,
    { expiresIn: '7d' }
  );

  return { accessToken, refreshToken };
}

Redis Session Storage

const redis = require('redis');
const client = redis.createClient();

class SessionStore {
  async create(userId, sessionData) {
    const sessionId = crypto.randomUUID();
    await client.hSet(`sessions:${userId}`, sessionId, JSON.stringify({
      ...sessionData,
      createdAt: Date.now()
    }));
    await client.expire(`sessions:${userId}`, 86400 * 7);
    return sessionId;
  }

  async invalidateAll(userId) {
    await client.del(`sessions:${userId}`);
  }
}

Cookie Configuration

app.use(session({
  name: 'session',
  secret: process.env.SESSION_SECRET,
  cookie: {
    httpOnly: true,
    secure: process.env.NODE_ENV === 'production',
    sameSite: 'strict',
    maxAge: 3600000, // 1 hour
    domain: '.example.com'
  },
  resave: false,
  saveUninitialized: false
}));

Token Refresh Flow

app.post('/auth/refresh', async (req, res) => {
  const { refreshToken } = req.cookies;

  try {
    const payload = jwt.verify(refreshToken, process.env.REFRESH_SECRET);
    if (payload.type !== 'refresh') throw new Error('Invalid token type');

    const user = await User.findById(payload.userId);
    const tokens = generateTokens(user);

    res.cookie('accessToken', tokens.accessToken, cookieOptions);
    res.json({ success: true });
  } catch (err) {
    res.status(401).json({ error: 'Invalid refresh token' });
  }
});

Security Requirements

  • Use HTTPS exclusively
  • Set httpOnly and sameSite on cookies
  • Implement proper token expiration
  • Use strong, unique secrets per environment
  • Validate signatures on every request

Never Do

  • Store sensitive data in tokens
  • Transmit tokens via URL parameters
  • Use weak or shared secrets
  • Skip signature validation

Comments

Markdown supported