iron-session 2.0.0-alpha.9 → 6.0.2

package/README.md

@@ -1,103 +1,656 @@
-# TSDX User Guide
+# iron-session [![GitHub license](https://img.shields.io/github/license/vvo/iron-session?style=flat)](https://github.com/vvo/iron-session/blob/master/LICENSE) [![Tests](https://github.com/vvo/iron-session/workflows/Tests/badge.svg)](https://github.com/vvo/iron-session/actions) ![npm](https://img.shields.io/npm/v/iron-session) [![Downloads](https://img.shields.io/npm/dm/next-iron-session.svg)](http://npm-stat.com/charts.html?package=iron-session)
 
-Congrats! You just saved yourself hours of work by bootstrapping this project with TSDX. Let’s get you oriented with what’s here and how to use it.
+<p align="center"><b>⭐️ Featured in the <a href="https://nextjs.org/docs/authentication">Next.js documentation</a></b></p>
 
-> This TSDX setup is meant for developing libraries (not apps!) that can be published to NPM. If you’re looking to build a Node app, you could use `ts-node-dev`, plain `ts-node`, or simple `tsc`.
+**⚠️ Nov 2021 update**: The library was renamed to `iron-session` and fully rewritten in TypeScript, it includes lots of new features and fixes. Follow the migration guide here: https://github.com/vvo/iron-session/releases/tag/v6.0.0.
 
-> If you’re new to TypeScript, checkout [this handy cheatsheet](https://devhints.io/typescript)
+_🛠 Node.js stateless session utility using signed and encrypted cookies to store data. Works with Next.js, Express, NestJs, Fastify, and any Node.js HTTP framework._
 
-## Commands
+The session data is stored in encrypted cookies ("seals"). And only your server can decode the session data. There are no session ids, making iron sessions "stateless" from the server point of view.
 
-TSDX scaffolds your new library inside `/src`.
+This strategy of storing session data is the same technique used by **frameworks like [Ruby On Rails](https://guides.rubyonrails.org/security.html#session-storage)** (their default strategy).
 
-To run TSDX, use:
+The underlying cryptography library is [iron](https://hapi.dev/module/iron) which was [created by the lead developer of OAuth 2.0](https://hueniversedotcom.wordpress.com/2015/09/19/auth-to-see-the-wizard-or-i-wrote-an-oauth-replacement/).
+
+<p align="center"><b>Online demo at <a href="https://iron-session-example.vercel.app/">https://iron-session-example.vercel.app</a> 👀</b></p>
+
+---
+
+_Table of contents:_
+
+- [Installation](#installation)
+- [Usage (Next.js)](#usage-nextjs)
+- [Advanced usage](#advanced-usage)
+  - [Coding best practices](#coding-best-practices)
+  - [Session wrappers](#session-wrappers)
+  - [Typing session data with TypeScript](#typing-session-data-with-typescript)
+  - [Express](#express)
+  - [Handle password rotation/update the password](#handle-password-rotationupdate-the-password)
+  - [Magic links](#magic-links)
+  - [Impersonation, login as someone else](#impersonation-login-as-someone-else)
+  - [Session cookies](#session-cookies)
+  - [Firebase usage](#firebase-usage)
+- [API](#api)
+  - [ironOptions](#ironoptions)
+  - [Next.js: withIronSessionApiRoute(handler, ironOptions)](#nextjs-withironsessionapiroutehandler-ironoptions)
+  - [Next.js: withIronSessionSsr(handler, ironOptions)](#nextjs-withironsessionssrhandler-ironoptions)
+  - [Express: ironSession(ironOptions)](#express-ironsessionironoptions)
+  - [session.save()](#sessionsave)
+  - [session.destroy()](#sessiondestroy)
+- [FAQ](#faq)
+  - [Why use pure cookies for sessions?](#why-use-pure-cookies-for-sessions)
+  - [What are the drawbacks?](#what-are-the-drawbacks)
+  - [How is this different from JWT?](#how-is-this-different-from-jwt)
+- [Project status](#project-status)
+- [Credits](#credits)
+- [References](#references)
+- [Contributors](#contributors)
+
+## Installation
 
 ```bash
-npm start # or yarn start
+npm add iron-session
+```
+
+## Usage (Next.js)
+
+You can find full featured examples (Next.js, Express) in the [examples folder](examples).
+
+The password is a private key you must pass at runtime and builtime (for getServerSideProps), it has to be at least 32 characters long. You can use https://1password.com/password-generator/ to generate strong passwords.
+
+Session duration is 14 days by default, check the API docs for more info.
+
+⚠️ Always store passwords in encrypted environment variables on your platform. Vercel does this automatically.
+
+**Login API Route:**
+
+```ts
+// pages/api/login.ts
+
+import { withIronSessionApiRoute } from "iron-session/next";
+
+export default withIronSessionApiRoute(
+  async function loginRoute(req, res) {
+    // get user from database then:
+    req.session.user = {
+      id: 230,
+      admin: true,
+    };
+    await req.session.save();
+    res.send({ ok: true });
+  },
+  {
+    cookieName: "myapp_cookiename",
+    password: "complex_password_at_least_32_characters_long",
+  },
+);
+```
+
+**User API Route:**
+
+```ts
+// pages/api/user.ts
+
+import { withIronSessionApiRoute } from "iron-session/next";
+
+export default withIronSessionApiRoute(
+  function userRoute(req, res) {
+    res.send({ user: req.session.user });
+  },
+  {
+    cookieName: "myapp_cookiename",
+    password: "complex_password_at_least_32_characters_long",
+  },
+);
+```
+
+**Logout Route:**
+
+```ts
+// pages/api/logout.ts
+
+import { withIronSessionApiRoute } from "iron-session/next";
+
+export default withIronSessionApiRoute(
+  function logoutRoute(req, res, session) {
+    req.session.destroy();
+    res.send({ ok: true });
+  },
+  {
+    cookieName: "myapp_cookiename",
+    password: "complex_password_at_least_32_characters_long",
+  },
+);
+```
+
+**getServerSideProps:**
+
+```ts
+// pages/admin.tsx
+
+import { withIronSessionSsr } from "iron-session/next";
+
+export const getServerSideProps = withIronSessionSsr(
+  async function getServerSideProps({ req }) {
+    const user = req.session.user;
+
+    if (user.admin !== true) {
+      return {
+        notFound: true,
+      };
+    }
+
+    return {
+      props: {
+        user: req.session.user,
+      },
+    };
+  },
+  {
+    cookieName: "myapp_cookiename",
+    password: "complex_password_at_least_32_characters_long",
+  },
+);
+```
+
+Note: We encourage you to create a `withSession` utility so you do not have to repeat the password and cookie name in every route. You can see how to do that [in the example](./examples/next.js-typescript/lib/session.ts).
+
+## Advanced usage
+
+### Coding best practices
+
+Here's an example Login API route that is easier to read because of less nesting:
+
+```ts
+// pages/api/login.ts
+
+import { withIronSessionApiRoute } from "iron-session/next";
+import { ironOptions } from "lib/config";
+
+export default withIronSessionApiRoute(loginRoute, ironOptions);
+
+async function loginRoute(req, res) {
+    // get user from database then:
+    req.session.user = {
+      id: 230,
+      admin: true,
+    };
+    await req.session.save();
+    res.send({ ok: true });
+  }
+);
+```
+
+```ts
+// lib/config.ts
+
+export const ironOptions = {
+  cookieName: "myapp_cookiename",
+  password: "complex_password_at_least_32_characters_long",
+};
+```
+
+### Session wrappers
+
+If you do not want to pass down the password and cookie name in every API route file or page then you can create wrappers like this:
+
+**JavaScript:**
+
+```js
+// lib/withSession.js
+
+import { withIronSessionApiRoute, withIronSessionSsr } from "iron-session/next";
+
+const sessionOptions = {
+  password: "complex_password_at_least_32_characters_long",
+  cookieName: "myapp_cookiename",
+};
+
+export function withSessionRoute(handler) {
+  return withIronSessionApiRoute(handler, sessionOptions);
+}
+
+export function withSessionSsr(handler) {
+  return withIronSessionSsr(handler, sessionOptions);
+}
 ```
 
-This builds to `/dist` and runs the project in watch mode so any edits you save inside `src` causes a rebuild to `/dist`.
+**TypeScript:**
 
-To do a one-off build, use `npm run build` or `yarn build`.
+```ts
+// lib/withSession.ts
 
-To run tests, use `npm test` or `yarn test`.
+import { withIronSessionApiRoute, withIronSessionSsr } from "iron-session/next";
+import {
+  GetServerSidePropsContext,
+  GetServerSidePropsResult,
+  NextApiHandler,
+} from "next";
 
-## Configuration
+const sessionOptions = {
+  password: "complex_password_at_least_32_characters_long",
+  cookieName: "myapp_cookiename",
+};
 
-Code quality is set up for you with `prettier`, `husky`, and `lint-staged`. Adjust the respective fields in `package.json` accordingly.
+export function withSessionRoute(handler: NextApiHandler) {
+  return withIronSessionApiRoute(handler, sessionOptions);
+}
 
-### Jest
+// Theses types are compatible with InferGetStaticPropsType https://nextjs.org/docs/basic-features/data-fetching#typescript-use-getstaticprops
+export function withSessionSsr<
+  P extends { [key: string]: unknown } = { [key: string]: unknown },
+>(
+  handler: (
+    context: GetServerSidePropsContext,
+  ) => GetServerSidePropsResult<P> | Promise<GetServerSidePropsResult<P>>,
+) {
+  return withIronSessionSsr(handler, sessionOptions);
+}
+```
+
+**Usage in API Routes:**
+
+```ts
+// pages/api/login.ts
+
+import { withSessionApiRoute } from "lib/withSession";
 
-Jest tests are set up to run with `npm test` or `yarn test`.
+export default withSessionApiRoute(loginRoute);
 
-### Bundle Analysis
+async function loginRoute(req, res) {
+  // get user from database then:
+  req.session.user = {
+    id: 230,
+    admin: true,
+  };
+  await req.session.save();
+  res.send("Logged in");
+}
+```
+
+**Usage in getServerSideProps:**
 
-[`size-limit`](https://github.com/ai/size-limit) is set up to calculate the real cost of your library with `npm run size` and visualize the bundle with `npm run analyze`.
+```ts
+// pages/admin.tsx
 
-#### Setup Files
+import { withSessionSsr } from "lib/withSession";
 
-This is the folder structure we set up for you:
+export const getServerSideProps = withIronSessionSsr(
+  async function getServerSideProps({ req }) {
+    const user = req.session.user;
 
-```txt
-/src
-  index.tsx       # EDIT THIS
-/test
-  blah.test.tsx   # EDIT THIS
-.gitignore
-package.json
-README.md         # EDIT THIS
-tsconfig.json
+    if (user.admin !== true) {
+      return {
+        notFound: true,
+      };
+    }
+
+    return {
+      props: {
+        user: req.session.user,
+      },
+    };
+  },
+);
 ```
 
-### Rollup
+### Typing session data with TypeScript
 
-TSDX uses [Rollup](https://rollupjs.org) as a bundler and generates multiple rollup configs for various module formats and build settings. See [Optimizations](#optimizations) for details.
+`req.session` is automatically populated with the right types so .save() and .destroy() can be called on it.
 
-### TypeScript
+But you might want to go further and type your session data also. To do so, use [module augmentation](https://www.typescriptlang.org/docs/handbook/declaration-merging.html#module-augmentation):
 
-`tsconfig.json` is set up to interpret `dom` and `esnext` types, as well as `react` for `jsx`. Adjust according to your needs.
+```ts
+declare module "iron-session" {
+  interface IronSessionData {
+    user?: {
+      id: number;
+      admin?: boolean;
+    };
+  }
+}
+```
+
+You can put this code anywhere in your project, as long as it is in a file that will be required at some point. For example it could be inside your `lib/withSession.ts` wrapper or inside an [`additional.d.ts`](https://nextjs.org/docs/basic-features/typescript) if you're using Next.js.
+
+We've taken this technique from [express-session types](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/master/types/express-session). If you have any comment on
+
+### Express
+
+See [examples/express](examples/express) for an example of how to use this with Express.
 
-## Continuous Integration
+### Handle password rotation/update the password
 
-### GitHub Actions
+When you want to:
 
-Two actions are added by default:
+- rotate passwords for better security every two (or more, or less) weeks
+- change the password you previously used because it leaked somewhere (😱)
 
-- `main` which installs deps w/ cache, lints, tests, and builds on all pushes against a Node and OS matrix
-- `size` which comments cost comparison of your library on every pull request using [`size-limit`](https://github.com/ai/size-limit)
+Then you can use multiple passwords:
 
-## Optimizations
+**Week 1**:
 
-Please see the main `tsdx` [optimizations docs](https://github.com/palmerhq/tsdx#optimizations). In particular, know that you can take advantage of development-only optimizations:
+```js
+withIronSessionApiRoute(handler, {
+  password: {
+    1: "complex_password_at_least_32_characters_long",
+  },
+});
+```
+
+**Week 2**:
 
 ```js
-// ./types/index.d.ts
-declare var __DEV__: boolean;
+withIronSessionApiRoute(handler, {
+  password: {
+    2: "another_password_at_least_32_characters_long",
+    1: "complex_password_at_least_32_characters_long",
+  },
+});
+```
+
+**Notes:**
+
+- The password used to encrypt session data (to `seal`) is always the highest number found in the map (2 in the example).
+- The passwords used to decrypt session data are all passwords in the map (this is how rotation works).
+- Even if you do not provide a list at first, you can always move to multiple passwords afterwards. The first password you've used has a default id of 1.
+
+### Magic links
+
+Because of the stateless nature of `iron-session`, it's very easy to implement patterns like magic links. For example, you might want to send an email to the user with a link to a page where they will be automatically logged in. Or you might want to send a Slack message to someone with a link to your application where they will be automatically logged in.
+
+Here's how to implement that:
+
+**Send an email with a magic link to the user**:
+
+```ts
+// pages/api/sendEmail.ts
+
+import { sealData } from "iron-session";
+
+export default async function sendEmailRoute(req, res) {
+  const user = getUserFromDatabase(req.query.userId);
+
+  const seal = await sealData(
+    {
+      userId: user.id,
+    },
+    {
+      password: "complex_password_at_least_32_characters_long",
+    },
+  );
+
+  await sendEmail(
+    user.email,
+    "Magic link",
+    `Hey there ${user.name}, <a href="https://myapp.com/api/magicLogin?seal=${seal}">click here to login</a>.`,
+  );
 
-// inside your code...
-if (__DEV__) {
-  console.log('foo');
+  res.send({ ok: true });
 }
 ```
 
-You can also choose to install and use [invariant](https://github.com/palmerhq/tsdx#invariant) and [warning](https://github.com/palmerhq/tsdx#warning) functions.
+**Login the user automatically and redirect:**
+
+```ts
+// pages/api/magicLogin.ts
+
+import { unsealData } from "iron-session";
+import { withIronSessionApiRoute } from "iron-session/next";
+
+const ironOptions = {
+  password: "complex_password_at_least_32_characters_long",
+};
+
+export default withIronSessionApiRoute(magicLoginRoute, ironOptions);
+
+async function magicLoginRoute(req, res) {
+  const { userId } = await unsealData(req.query.seal, ironOptions);
+
+  const user = getUserFromDatabase(userId);
+
+  req.session.user = {
+    id: user.id,
+  };
+
+  await req.session.save();
+
+  res.redirect(`/dashboard`);
+}
+```
+
+You might want to include error handling in the API routes. For example checking if `req.session.user` is already defined in login or handling bad seals.
+
+### Impersonation, login as someone else
+
+You may want to impersonate your own users, to check how they see your application. This can be extremely useful. For example you could have a page that list all your users and with links you can click to impersonate them.
+
+**Login as someone else:**
+
+```ts
+// pages/api/impersonate.ts
+
+import { withIronSessionApiRoute } from "iron-session/next";
+
+export default withIronSessionApiRoute(impersonateRoute, {
+  password: "complex_password_at_least_32_characters_long",
+});
+
+async function impersonateRoute(req, res) {
+  if (!req.session.isAdmin) {
+    // let's pretend this route does not exists if user is not an admin
+    return res.status(404).end();
+  }
+
+  req.session.originalUser = req.session.originalUser || req.session.user;
+  req.session.user = {
+    id: req.query.userId,
+  };
+  await req.session.save();
+  res.redirect("/dashboard");
+}
+```
+
+**Stop impersonation:**
+
+```ts
+// pages/api/stopImpersonate.ts
+
+import { withIronSessionApiRoute } from "iron-session/next";
+
+export default withIronSessionApiRoute(stopImpersonateRoute, {
+  password: "complex_password_at_least_32_characters_long",
+});
+
+async function stopImpersonateRoute(req, res) {
+  if (!req.session.isAdmin) {
+    // let's pretend this route does not exists if user is not an admin
+    return res.status(404).end();
+  }
+
+  req.session.user = req.session.originalUser;
+  delete req.session.originalUser;
+  await req.session.save();
+  res.redirect("/dashboard");
+}
+```
+
+### Session cookies
+
+If you want cookies to expire when the user closes the browser, pass `maxAge: undefined` in cookie options, this way:
+
+```ts
+// pages/api/user.ts
+
+import { withIronSessionApiRoute } from "iron-session/next";
+
+export default withIronSessionApiRoute(
+  function userRoute(req, res) {
+    res.send({ user: req.session.user });
+  },
+  {
+    cookieName: "myapp_cookiename",
+    password: "complex_password_at_least_32_characters_long",
+    cookieOptions: { maxAge: undefined },
+  },
+);
+```
+
+Beware, modern browsers might not delete cookies at all using this technique because of [session restoring](https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies#define_the_lifetime_of_a_cookie).
+
+### Firebase usage
+
+This library can be used with Firebase, as long as you set the cookie name to `__session` which seems to be the only valid cookie name there.
+
+## API
+
+### ironOptions
+
+Only two options are required: `password` and `cookieName`. Everything else is automatically computed and usually doesn't need to be changed.
+
+- `password`, **required**: Private key used to encrypt the cookie. It has to be at least 32 characters long. Use https://1password.com/password-generator/ to generate strong passwords. `password` can be either a `string` or an `array` of objects like this: `[{id: 2, password: "..."}, {id: 1, password: "..."}]` to allow for password rotation.
+- `cookieName`, **required**: Name of the cookie to be stored
+- `ttl`, _optional_: In seconds, default to 14 days
+- [`cookieOptions`](https://github.com/jshttp/cookie#cookieserializename-value-options), _optional_: Any option available from [jshttp/cookie#serialize](https://github.com/jshttp/cookie#cookieserializename-value-options). Default to:
+
+```js
+{
+  httpOnly: true,
+  secure: true, // true when using https, false otherwise
+  sameSite: "lax", // https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite#lax
+  // The next line makes sure browser will expire cookies before seals are considered expired by the server. It also allows for clock difference of 60 seconds maximum between servers and clients.
+  maxAge: (ttl === 0 ? 2147483647 : ttl) - 60,
+  path: "/",
+  // other options:
+  // domain, if you want the cookie to be valid for the whole domain and subdomains, use domain: example.com
+  // encode, there should be no need to use this option, encoding is done by iron-session already
+  // expires, there should be no need to use this option, maxAge takes precedence
+}
+```
+
+### Next.js: withIronSessionApiRoute(handler, ironOptions)
+
+Wraps a [Next.js API Route](https://nextjs.org/docs/api-routes/dynamic-api-routes) and adds a `session` object to the request.
+
+```ts
+import { withIronSessionApiRoute } from "iron-session/next";
+
+export default withIronSessionApiRoute(
+  function userRoute(req, res) {
+    res.send({ user: req.session.user });
+  },
+  {
+    cookieName: "myapp_cookiename",
+    password: "complex_password_at_least_32_characters_long",
+  },
+);
+```
+
+### Next.js: withIronSessionSsr(handler, ironOptions)
+
+Wraps a [Next.js getServerSideProps](https://nextjs.org/docs/basic-features/data-fetching#getserversideprops-server-side-rendering) and adds a `session` object to the request of the context.
+
+```ts
+import { withIronSessionSsr } from "iron-session/next";
+
+export const getServerSideProps = withIronSessionSsr(
+  async function getServerSideProps({ req }) {
+    return {
+      props: {
+        user: req.session.user,
+      },
+    };
+  },
+  {
+    cookieName: "myapp_cookiename",
+    password: "complex_password_at_least_32_characters_long",
+  },
+);
+```
+
+### Express: ironSession(ironOptions)
+
+Creates an express middleware that adds a `session` object to the request.
+
+```js
+import { ironSession } from "iron-session";
+
+app.use(ironSession(ironOptions));
+```
+
+### session.save()
+
+Saves the session and sets the cookie header to be sent once the response is sent.
+
+```ts
+await req.session.save();
+```
+
+### session.destroy()
+
+Empties the session object and sets the cookie header to be sent once the response is sent. The browser will then remove the cookie automatically.
+
+You don't have to call `req.session.save()` after calling `req.session.destroy()`. The session is saved automatically.
+
+## FAQ
+
+### Why use pure cookies for sessions?
+
+This makes your sessions stateless: you do not have to store session data on your server. You do not need another server or service to store session data. This is particularly useful in serverless architectures where you're trying to reduce your backend dependencies.
+
+### What are the drawbacks?
+
+There are some drawbacks to this approach:
+
+- you cannot invalidate a seal when needed because there's no state stored on the server-side about them. We consider that the way the cookie is stored reduces the possibility for this eventuality to happen. Also, in most applications the first thing you do when receiving an authenticated request is to validate the user and their rights in your database, which defeats the case where someone would try to use a token while their account was deactivated/deleted. Now if someone steals a user token you should have a process in place to mitigate that: deactivate the user and force a re-login with a flag in your database for example.
+- application not supporting cookies won't work, but you can use [iron-store](https://github.com/vvo/iron-store/) to implement something similar. In the future, we could allow `iron-session` to accept [basic auth](https://tools.ietf.org/html/rfc7617) or bearer token methods too. Open an issue if you're interested.
+- on most browsers, you're limited to 4,096 bytes per cookie. To give you an idea, an `iron-session` cookie containing `{user: {id: 100}}` is 265 bytes signed and encrypted: still plenty of available cookie space in here.
+- performance: crypto on the server-side could be slow, if that's the case let me know. Also, cookies are sent to every request to your website, even images, so this could be an issue
+
+Now that you know the drawbacks, you can decide if they are an issue for your application or not.
+More information can also be found on the [Ruby On Rails website](https://guides.rubyonrails.org/security.html#session-storage) which uses the same technique.
+
+### How is this different from [JWT](https://jwt.io/)?
+
+Not so much:
+
+- JWT is a standard, it stores metadata in the JWT token themselves to ensure communication between different systems is flawless.
+- JWT tokens are not encrypted, the payload is visible by customers if they manage to inspect the seal. You would have to use [JWE](https://tools.ietf.org/html/rfc7516) to achieve the same.
+- @hapi/iron mechanism is not a standard, it's a way to sign and encrypt data into seals
+
+Depending on your own needs and preferences, `iron-session` may or may not fit you.
+
+## Project status
+
+✅ Production ready and maintained.
+
+## Credits
 
-## Module Formats
+Thanks to [Hoang Vo](https://github.com/hoangvvo) for advice and guidance while building this module. Hoang built [next-connect](https://github.com/hoangvvo/next-connect) and [next-session](https://github.com/hoangvvo/next-session).
 
-CJS, ESModules, and UMD module formats are supported.
+Thanks to [hapi](https://hapi.dev/) team for creating [iron](https://github.com/hapijs/iron).
 
-The appropriate paths are configured in `package.json` and `dist/index.js` accordingly. Please report if any issues are found.
+## References
 
-## Named Exports
+- https://owasp.org/www-project-cheat-sheets/cheatsheets/Session_Management_Cheat_Sheet.html#cookies
+- https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html#samesite-cookie-attribute
 
-Per Palmer Group guidelines, [always use named exports.](https://github.com/palmerhq/typescript#exports) Code split inside your React app instead of your React library.
+## Contributors
 
-## Including Styles
+Thanks goes to these wonderful people ([emoji key](https://allcontributors.org/docs/en/emoji-key)):
 
-There are many ways to ship styles, including with CSS-in-JS. TSDX has no opinion on this, configure how you like.
+<!-- ALL-CONTRIBUTORS-LIST:START - Do not remove or modify this section -->
+<!-- prettier-ignore-start -->
+<!-- markdownlint-disable -->
+<table>
+  <tr>
+    <td align="center"><a href="http://www.afterecon.com/"><img src="https://avatars.githubusercontent.com/u/5559355?v=4?s=100" width="100px;" alt=""/><br /><sub><b>John Vandivier</b></sub></a><br /><a href="https://github.com/vvo/iron-session/commits?author=Vandivier" title="Code">💻</a> <a href="#ideas-Vandivier" title="Ideas, Planning, & Feedback">🤔</a> <a href="#example-Vandivier" title="Examples">💡</a></td>
+  </tr>
+</table>
 
-For vanilla CSS, you can include it at the root directory and add it to the `files` section in your `package.json`, so that it can be imported separately by your users and run through their bundler's loader.
+<!-- markdownlint-restore -->
+<!-- prettier-ignore-end -->
 
-## Publishing to NPM
+<!-- ALL-CONTRIBUTORS-LIST:END -->
 
-We recommend using [np](https://github.com/sindresorhus/np).
+This project follows the [all-contributors](https://github.com/all-contributors/all-contributors) specification. Contributions of any kind welcome!