hono-sessions 0.3.2 → 0.3.4

package/README.md

@@ -1,15 +1,30 @@
 # Hono Sessions Middleware
-Use cookie-based sessions with the [Hono](https://hono.dev/) framework. Currently tested to work with Deno, Cloudflare Workers, and Bun.
+Use cookie-based sessions with the [Hono](https://hono.dev/) framework.
+
+### Supported runtimes
+
+Hono Sessions is currently tested on these runtimes:
+
+- Deno
+- Cloudflare Workers
+- Bun
+- Node (v20+)
+
+Other runtimes may work, but are untested. In addition to Hono's requirements, the [Web Crypto API](https://developer.mozilla.org/en-US/docs/Web/API/Web_Crypto_API) is required for this library.
+
+If you want to use a backend storage driver (instead of just storing session data in an encrypted cookie), you'll need to use a storage engine provided by Hono Sessions. Right now, those include:
+
+- Deno KV
+- Bun SQLite
 
 ### 🛠️ Features
-- Runs in Deno, Cloudflare Workers, and Bun (possibly others, currently untested)
 - Flash messages — data that is deleted once it's read (one-off error messages, etc.)
 - Built-in Memory and Cookie storage drivers (more coming soon)
 - Encrypted cookies thanks to [iron-webcrypto](https://github.com/brc-dd/iron-webcrypto)
 - Session expiration after inactivity
 - Session key rotation* 
 
-> *CookieStore is not able to rotate session keys by nature of how a pure cookie session works (no server-side state).
+> *It is not necessary to rotate CookieStore sessions because of how a pure cookie session works (no server-side state). Therefore, using session key rotation will have no effect while using CookieStore.
 
 ## Installation and Usage
 
@@ -21,7 +36,7 @@ Simply include the package from `deno.land/x`
 import { sessionMiddleware } from 'https://deno.land/x/hono_sessions/mod.ts'
 ```
 
-### Bun, Cloudflare Workers
+### Node, Bun, Cloudflare Workers, etc.
 
 Install the NPM package
 ```
@@ -32,7 +47,7 @@ npm install hono-sessions
 
 ### Deno
 ```ts
-import { Hono } from 'https://deno.land/x/hono@v3.5.8/mod.ts'
+import { Hono } from 'https://deno.land/x/hono@v3.12.8/mod.ts'
 import { 
   Session,
   sessionMiddleware, 
@@ -51,9 +66,11 @@ const store = new CookieStore()
 app.use('*', sessionMiddleware({
   store,
   encryptionKey: 'password_at_least_32_characters_long', // Required for CookieStore, recommended for others
-  expireAfterSeconds: 900, // Expire session after 15 minutes
+  expireAfterSeconds: 900, // Expire session after 15 minutes of inactivity
   cookieOptions: {
-    sameSite: 'Lax',
+    sameSite: 'Lax', // Recommended for basic CSRF protection in modern browsers
+    path: '/', // Required for this library to work properly
+    httpOnly: true, // Recommended to avoid XSS attacks
   },
 }))
 
@@ -75,7 +92,7 @@ Deno.serve(app.fetch)
 #### Using Deno KV storage driver
 
 ```ts
-import { Hono } from 'https://deno.land/x/hono@v3.5.8/mod.ts'
+import { Hono } from 'https://deno.land/x/hono@v3.12.8/mod.ts'
 import { sessionMiddleware } from 'https://deno.land/x/hono_sessions/mod.ts'
 import { DenoKvStore } from 'https://deno.land/x/hono_sessions/src/store/deno/DenoKvStore.ts'
 
@@ -168,4 +185,4 @@ There's also a [Playwright](https://playwright.dev/) test suite. By default, it
 cd playwright
 npm install
 npx playwright test
-```
+```

package/esm/src/Crypto.d.ts

@@ -1,2 +1,2 @@
-export declare function encrypt(password: string, payload: Object | string): Promise<string>;
+export declare function encrypt(password: string, payload: object | string): Promise<string>;
 export declare function decrypt(password: string, encrypted: string): Promise<unknown>;

package/package.json

@@ -2,7 +2,7 @@
   "module": "./esm/mod.js",
   "main": "./script/mod.js",
   "name": "hono-sessions",
-  "version": "0.3.2",
+  "version": "0.3.4",
   "description": "Cookie-based sessions for Hono web framework",
   "license": "MIT",
   "repository": {
@@ -27,7 +27,7 @@
     }
   },
   "dependencies": {
-    "hono": "3.5.8",
+    "hono": "3.12.8",
     "iron-webcrypto": "0.10.1",
     "nanoid": "4.0.0"
   }

package/script/src/Crypto.d.ts

@@ -1,2 +1,2 @@
-export declare function encrypt(password: string, payload: Object | string): Promise<string>;
+export declare function encrypt(password: string, payload: object | string): Promise<string>;
 export declare function decrypt(password: string, encrypted: string): Promise<unknown>;