timeout(+Seconds)

Session timeout in seconds. Default is 600 (10 min). A timeout of 0 (zero) disables timeout.

cookie(+Cookiekname)

Name to use for the cookie to identify the session. Default swipl_session.

path(+Path)

Path to which the cookie is associated. Default is /. Cookies are only sent if the HTTP request path is a refinement of Path.

route(+Route)

Set the route name. Default is the unqualified hostname. To cancel adding a route, use the empty atom. See route/1.

enabled(+Boolean)

Enable/disable session management. Session management is enabled by default after loading this file.

create(+Atom)

Defines when a session is created. This is one of auto (default), which creates a session if there is a request whose path matches the defined session path or noauto, in which cases sessions are only created by calling http_open_session/2 explicitly.

proxy_enabled(+Boolean)

Enable/disable proxy session management. Proxy session management associates the originating IP address of the client to the session rather than the proxy IP address. Default is false.

gc(+When)

When is one of active, which starts a thread that performs session cleanup at close to the moment of the timeout or passive, which runs session GC when a new session is created.

samesite(+Restriction)

One of none, lax (default), or strict - The SameSite attribute prevents the CSRF vulnerability. strict has best security, but prevents links from external sites from operating properly. lax stops most CSRF attacks against REST endpoints but rarely interferes with legit image operations. none removes the samesite attribute entirely. Caution: The value none exposes the entire site to CSRF attacks.

http_only(+Boolean)

If true (default false), add the HttpOnly property to the session cookie. This causes the browser to deny access from JavaScript.

secure(+Boolean)

If true, (default false), add the Secure property to the session cookie. This causes the browser to report the cookie only over HTTPS connections.

granularity(+Integer)

Granularity for updating that the session is active. Default is 60 (seconds). Smaller values lead to more precise session timeout at the cost of more database updates. This may notably a problem when using Redis.

In addition, extension libraries can define session_option/2 to make this predicate support more options. In particular, library(http/http_redis_plugin) defines the following additional options:

redis_db(+DB)

Alias name of the redis database to access. See redis_server/3.

redis_ro(+DB)

Alias name of the redis database for read-only access. See redis_server/3.

redis_prefix(+Atom)

Prefix to use for all HTTP session related keys. Default is 'swipl:http:session'