// src/config/sessionConfig.ts
import session from 'express-session';
import RedisStore from 'connect-redis';
import { createClient } from 'redis';
import type { SessionOptions } from 'express-session';

// Initialize Redis client
export const redisClient = createClient({
  url: process.env.REDIS_URL || 'redis://localhost:6379',
  socket: {
    reconnectStrategy: (retries) => {
      if (retries > 10) {
        console.error('Redis reconnection failed after 10 attempts');
        return new Error('Redis max retries exceeded');
      }
      return retries * 100; // Exponential backoff
    },
  },
});

redisClient.on('error', (err) => {
  console.error('Redis error:', err);
});

redisClient.on('connect', () => {
  console.log('Connected to Redis');
});

// Connect Redis client
export const initializeRedis = async () => {
  await redisClient.connect();
};

// Session configuration
export const sessionConfig: SessionOptions = {
  // Store configuration
  store: new RedisStore({ client: redisClient }),

  // Session ID configuration
  genid: (req) => {
    // Use cryptographically secure random ID generation
    return require('crypto').randomBytes(32).toString('hex');
  },

  // Secret for signing session ID cookie
  secret: process.env.SESSION_SECRET || 'your-super-secret-key-change-in-production',

  // Resave: save session even if unmodified
  // Set to false for better performance with Redis
  resave: false,

  // Save uninitialized sessions
  // Set to false for better security (don't create sessions until login)
  saveUninitialized: false,

  // Name of the session ID cookie
  name: 'sessionId',

  // Session expiration (24 hours)
  cookie: {
    // CRITICAL: Always use httpOnly in production
    httpOnly: true,

    // CRITICAL: Always use secure in production (HTTPS only)
    secure: process.env.NODE_ENV === 'production',

    // Prevent CSRF attacks by restricting when cookie is sent
    sameSite: 'strict' as const,

    // Session lifetime (24 hours in milliseconds)
    maxAge: 24 * 60 * 60 * 1000,

    // Domain restriction (optional but recommended)
    // domain: '.example.com', // Uncomment for production

    // Path restriction (optional)
    path: '/',
  },

  // Proxy configuration (important for production behind reverse proxy)
  proxy: process.env.NODE_ENV === 'production',
};

import org.springframework.context.annotation.*;
import org.springframework.session.data.redis.config.annotation.web.http.*;
import org.springframework.data.redis.connection.*;
import org.springframework.data.redis.connection.lettuce.LettuceConnectionFactory;
import org.springframework.boot.web.servlet.ServletContextInitializer;
import jakarta.servlet.SessionCookieConfig;

@Configuration
@EnableRedisHttpSession(maxInactiveIntervalInSeconds = 86400) // 24 hours
public class SessionConfig {

    @Bean
    public LettuceConnectionFactory redisConnectionFactory() {
        RedisStandaloneConfiguration cfg = new RedisStandaloneConfiguration();
        cfg.setHostName(System.getenv().getOrDefault("REDIS_HOST", "localhost"));
        cfg.setPort(Integer.parseInt(System.getenv().getOrDefault("REDIS_PORT", "6379")));
        return new LettuceConnectionFactory(cfg);
    }

    /** Configure the session cookie (httpOnly, Secure, SameSite=Strict). */
    @Bean
    public ServletContextInitializer sessionCookieConfig() {
        return servletContext -> {
            SessionCookieConfig cookieConfig = servletContext.getSessionCookieConfig();
            cookieConfig.setName("sessionId");
            cookieConfig.setHttpOnly(true);
            cookieConfig.setSecure(true);    // HTTPS only in production
            cookieConfig.setPath("/");
            cookieConfig.setMaxAge(86400);   // 24 hours
            // SameSite is set via response header or server config
        };
    }
}

# requirements: fastapi, redis, itsdangerous, starlette

import os
import secrets
from starlette.middleware.sessions import SessionMiddleware
from starlette.applications import Starlette
import redis.asyncio as aioredis

# Redis client (async)
redis_client = aioredis.from_url(
    os.getenv("REDIS_URL", "redis://localhost:6379"),
    encoding="utf-8",
    decode_responses=True,
)

SESSION_SECRET = os.getenv("SESSION_SECRET", secrets.token_hex(32))
SESSION_TTL    = 24 * 60 * 60  # 24 hours in seconds

# For FastAPI / Starlette, add the built-in SessionMiddleware
# (backed by a signed cookie — for Redis-backed sessions use a custom store)
from fastapi import FastAPI

app = FastAPI()
app.add_middleware(
    SessionMiddleware,
    secret_key   = SESSION_SECRET,
    session_cookie = "sessionId",
    max_age      = SESSION_TTL,
    https_only   = os.getenv("ENVIRONMENT") == "production",
    same_site    = "strict",
)

# Redis-backed custom session store helper
async def save_session(session_id: str, data: dict) -> None:
    import json
    await redis_client.setex(f"session:{session_id}", SESSION_TTL, json.dumps(data))

async def get_session(session_id: str) -> dict | None:
    import json
    raw = await redis_client.get(f"session:{session_id}")
    return json.loads(raw) if raw else None

async def delete_session(session_id: str) -> None:
    await redis_client.delete(f"session:{session_id}")

// Program.cs — ASP.NET Core 8 session configuration

using Microsoft.AspNetCore.DataProtection;
using StackExchange.Redis;

var builder = WebApplication.CreateBuilder(args);

// Redis connection
var redis = ConnectionMultiplexer.Connect(
    builder.Configuration.GetConnectionString("Redis") ?? "localhost:6379");

builder.Services.AddSingleton<IConnectionMultiplexer>(redis);

// Distributed session backed by Redis
builder.Services.AddStackExchangeRedisCache(options =>
{
    options.Configuration = builder.Configuration.GetConnectionString("Redis");
    options.InstanceName  = "session:";
});

builder.Services.AddSession(options =>
{
    options.IdleTimeout        = TimeSpan.FromHours(24);
    options.Cookie.Name        = "sessionId";
    options.Cookie.HttpOnly    = true;
    options.Cookie.SecurePolicy = CookieSecurePolicy.Always;
    options.Cookie.SameSite    = SameSiteMode.Strict;
    options.Cookie.IsEssential = true;
    options.Cookie.Path        = "/";
});

// Data protection (signs/encrypts session cookie value)
builder.Services.AddDataProtection()
    .PersistKeysToStackExchangeRedis(redis, "DataProtection-Keys");

var app = builder.Build();

app.UseSession();
app.MapControllers();
app.Run();

// src/models/User.ts
import bcrypt from 'bcryptjs';
import crypto from 'crypto';

export interface User {
  id: string;
  username: string;
  email: string;
  passwordHash: string;
  createdAt: Date;
  lastLoginAt: Date | null;
  loginAttempts: number;
  lockoutUntil: Date | null;
}

export interface SessionData {
  userId: string;
  username: string;
  email: string;
  role: string;
  loginTime: number;
  lastActivity: number;
  ipAddress: string;
  userAgent: string;
}

// Simulated database
const users: Map<string, User> = new Map();

export class UserService {
  static async createUser(
    username: string,
    email: string,
    password: string
  ): Promise<User> {
    const id = crypto.randomBytes(16).toString('hex');
    const passwordHash = await bcrypt.hash(password, 12);

    const user: User = {
      id,
      username,
      email,
      passwordHash,
      createdAt: new Date(),
      lastLoginAt: null,
      loginAttempts: 0,
      lockoutUntil: null,
    };

    users.set(id, user);
    return user;
  }

  static async verifyCredentials(
    email: string,
    password: string
  ): Promise<User | null> {
    // Find user by email
    let user: User | null = null;
    for (const u of users.values()) {
      if (u.email === email) {
        user = u;
        break;
      }
    }

    if (!user) {
      return null;
    }

    // Check if account is locked
    if (user.lockoutUntil && user.lockoutUntil > new Date()) {
      throw new Error('Account is temporarily locked due to too many login attempts');
    }

    // Verify password
    const isValid = await bcrypt.compare(password, user.passwordHash);

    if (isValid) {
      // Reset login attempts on successful login
      user.loginAttempts = 0;
      user.lockoutUntil = null;
      user.lastLoginAt = new Date();
      return user;
    } else {
      // Increment login attempts and implement lockout
      user.loginAttempts += 1;
      if (user.loginAttempts >= 5) {
        user.lockoutUntil = new Date(Date.now() + 15 * 60 * 1000); // 15-minute lockout
      }
      return null;
    }
  }

  static async getUserById(id: string): Promise<User | null> {
    return users.get(id) || null;
  }
}

import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
import org.springframework.stereotype.Service;
import java.security.SecureRandom;
import java.time.Instant;
import java.util.*;
import java.util.concurrent.ConcurrentHashMap;

public record User(
    String id,
    String username,
    String email,
    String passwordHash,
    Instant createdAt,
    Instant lastLoginAt,
    int loginAttempts,
    Instant lockoutUntil
) {}

public record SessionData(
    String userId,
    String username,
    String email,
    String role,
    long   loginTime,
    long   lastActivity,
    String ipAddress,
    String userAgent
) {}

@Service
public class UserService {

    private final BCryptPasswordEncoder encoder = new BCryptPasswordEncoder(12);
    private final Map<String, User> users = new ConcurrentHashMap<>();

    public User createUser(String username, String email, String password) {
        String id           = UUID.randomUUID().toString();
        String passwordHash = encoder.encode(password);

        User user = new User(
            id, username, email, passwordHash,
            Instant.now(), null, 0, null
        );
        users.put(id, user);
        return user;
    }

    public User verifyCredentials(String email, String password) {
        User user = users.values().stream()
            .filter(u -> u.email().equals(email))
            .findFirst()
            .orElse(null);

        if (user == null) return null;

        if (user.lockoutUntil() != null && user.lockoutUntil().isAfter(Instant.now())) {
            throw new RuntimeException(
                "Account is temporarily locked due to too many login attempts");
        }

        if (encoder.matches(password, user.passwordHash())) {
            // Reset attempts — return updated user
            User updated = new User(user.id(), user.username(), user.email(),
                user.passwordHash(), user.createdAt(), Instant.now(), 0, null);
            users.put(user.id(), updated);
            return updated;
        } else {
            int attempts = user.loginAttempts() + 1;
            Instant lockout = attempts >= 5
                ? Instant.now().plusSeconds(15 * 60)
                : user.lockoutUntil();
            users.put(user.id(), new User(user.id(), user.username(), user.email(),
                user.passwordHash(), user.createdAt(), user.lastLoginAt(), attempts, lockout));
            return null;
        }
    }

    public Optional<User> getUserById(String id) {
        return Optional.ofNullable(users.get(id));
    }
}

import bcrypt
import secrets
from datetime import datetime, timedelta, timezone
from dataclasses import dataclass, field
from typing import Optional

@dataclass
class User:
    id: str
    username: str
    email: str
    password_hash: str
    created_at: datetime
    last_login_at: Optional[datetime] = None
    login_attempts: int = 0
    lockout_until: Optional[datetime] = None

@dataclass
class SessionData:
    user_id: str
    username: str
    email: str
    role: str
    login_time: float
    last_activity: float
    ip_address: str
    user_agent: str

# In-memory store (replace with a real DB in production)
_users: dict[str, User] = {}

class UserService:
    @staticmethod
    async def create_user(username: str, email: str, password: str) -> User:
        user_id       = secrets.token_hex(16)
        password_hash = bcrypt.hashpw(password.encode(), bcrypt.gensalt(rounds=12)).decode()

        user = User(
            id=user_id,
            username=username,
            email=email,
            password_hash=password_hash,
            created_at=datetime.now(timezone.utc),
        )
        _users[user_id] = user
        return user

    @staticmethod
    async def verify_credentials(email: str, password: str) -> Optional[User]:
        user = next((u for u in _users.values() if u.email == email), None)
        if not user:
            return None

        now = datetime.now(timezone.utc)
        if user.lockout_until and user.lockout_until > now:
            raise ValueError("Account is temporarily locked due to too many login attempts")

        if bcrypt.checkpw(password.encode(), user.password_hash.encode()):
            user.login_attempts = 0
            user.lockout_until  = None
            user.last_login_at  = now
            return user
        else:
            user.login_attempts += 1
            if user.login_attempts >= 5:
                user.lockout_until = now + timedelta(minutes=15)
            return None

    @staticmethod
    async def get_user_by_id(user_id: str) -> Optional[User]:
        return _users.get(user_id)

using Microsoft.AspNetCore.Identity;

public class User
{
    public string   Id            { get; set; } = Guid.NewGuid().ToString();
    public string   Username      { get; set; } = "";
    public string   Email         { get; set; } = "";
    public string   PasswordHash  { get; set; } = "";
    public DateTime CreatedAt     { get; set; } = DateTime.UtcNow;
    public DateTime? LastLoginAt  { get; set; }
    public int      LoginAttempts { get; set; }
    public DateTime? LockoutUntil { get; set; }
}

public class SessionData
{
    public string UserId       { get; set; } = "";
    public string Username     { get; set; } = "";
    public string Email        { get; set; } = "";
    public string Role         { get; set; } = "";
    public long   LoginTime    { get; set; }
    public long   LastActivity { get; set; }
    public string IpAddress    { get; set; } = "";
    public string UserAgent    { get; set; } = "";
}

public class UserService
{
    private readonly Dictionary<string, User>   _users   = new();
    private readonly IPasswordHasher<User>       _hasher  = new PasswordHasher<User>();

    public Task<User> CreateUserAsync(string username, string email, string password)
    {
        var user = new User { Username = username, Email = email };
        user.PasswordHash = _hasher.HashPassword(user, password);
        _users[user.Id] = user;
        return Task.FromResult(user);
    }

    public Task<User?> VerifyCredentialsAsync(string email, string password)
    {
        var user = _users.Values.FirstOrDefault(u => u.Email == email);
        if (user is null) return Task.FromResult<User?>(null);

        if (user.LockoutUntil.HasValue && user.LockoutUntil > DateTime.UtcNow)
            throw new Exception("Account is temporarily locked");

        var result = _hasher.VerifyHashedPassword(user, user.PasswordHash, password);
        if (result == PasswordVerificationResult.Success)
        {
            user.LoginAttempts = 0;
            user.LockoutUntil  = null;
            user.LastLoginAt   = DateTime.UtcNow;
            return Task.FromResult<User?>(user);
        }

        user.LoginAttempts++;
        if (user.LoginAttempts >= 5)
            user.LockoutUntil = DateTime.UtcNow.AddMinutes(15);

        return Task.FromResult<User?>(null);
    }

    public Task<User?> GetUserByIdAsync(string id) =>
        Task.FromResult(_users.GetValueOrDefault(id));
}

// src/app.ts
import express, { Express, Request, Response, NextFunction } from 'express';
import session from 'express-session';
import { sessionConfig } from './config/sessionConfig';
import { UserService, SessionData } from './models/User';
import csrf from 'csurf';
import cookieParser from 'cookie-parser';
import crypto from 'crypto';

// Extend Express Request type to include session data
declare global {
  namespace Express {
    interface Request {
      sessionID: string;
      session: {
        userId?: string;
        userData?: SessionData;
        csrfToken?: string;
      };
    }
  }
}

export const createApp = (): Express => {
  const app = express();

  // Middleware
  app.use(express.json());
  app.use(express.urlencoded({ extended: false }));
  app.use(cookieParser(process.env.SESSION_SECRET || 'your-secret'));

  // Session middleware
  app.use(session(sessionConfig));

  // CSRF protection middleware
  const csrfProtection = csrf({ cookie: false });

  // Middleware to attach session data to request
  app.use(async (req: Request, res: Response, next: NextFunction) => {
    if (req.session.userId) {
      const user = await UserService.getUserById(req.session.userId);
      if (user) {
        req.session.userData = {
          userId: user.id,
          username: user.username,
          email: user.email,
          role: 'user', // You'd get this from your database
          loginTime: req.session.loginTime || Date.now(),
          lastActivity: Date.now(),
          ipAddress: req.ip || '',
          userAgent: req.get('User-Agent') || '',
        };
      }
    }
    next();
  });

  // Authentication middleware
  const requireAuth = (req: Request, res: Response, next: NextFunction) => {
    if (!req.session.userId) {
      return res.status(401).json({ error: 'Not authenticated' });
    }
    next();
  };

  // ===== Public Routes =====

  // Register endpoint
  app.post('/api/auth/register', csrfProtection, async (req: Request, res: Response) => {
    try {
      const { username, email, password, confirmPassword } = req.body;

      // Validation
      if (!username || !email || !password || !confirmPassword) {
        return res.status(400).json({ error: 'Missing required fields' });
      }

      if (password !== confirmPassword) {
        return res.status(400).json({ error: 'Passwords do not match' });
      }

      if (password.length < 8) {
        return res.status(400).json({ error: 'Password must be at least 8 characters' });
      }

      const user = await UserService.createUser(username, email, password);

      // Create session after registration
      req.session.userId = user.id;
      req.session.loginTime = Date.now();

      res.status(201).json({
        message: 'User created successfully',
        user: { id: user.id, username: user.username, email: user.email },
      });
    } catch (error) {
      console.error('Registration error:', error);
      res.status(500).json({ error: 'Registration failed' });
    }
  });

  // Login endpoint
  app.post('/api/auth/login', csrfProtection, async (req: Request, res: Response) => {
    try {
      const { email, password, rememberMe } = req.body;

      if (!email || !password) {
        return res.status(400).json({ error: 'Email and password required' });
      }

      const user = await UserService.verifyCredentials(email, password);

      if (!user) {
        return res.status(401).json({ error: 'Invalid credentials' });
      }

      // Create session
      req.session.userId = user.id;
      req.session.loginTime = Date.now();

      // Optional: Extend session if "remember me" is selected
      if (rememberMe) {
        req.session.cookie.maxAge = 7 * 24 * 60 * 60 * 1000; // 7 days
      }

      // Regenerate session ID to prevent session fixation attacks
      req.session.regenerate((err) => {
        if (err) {
          return res.status(500).json({ error: 'Session creation failed' });
        }

        res.json({
          message: 'Login successful',
          user: {
            id: user.id,
            username: user.username,
            email: user.email,
          },
        });
      });
    } catch (error) {
      console.error('Login error:', error);
      res.status(500).json({ error: 'Login failed' });
    }
  });

  // Get CSRF token for forms
  app.get('/api/csrf-token', csrfProtection, (req: Request, res: Response) => {
    res.json({ csrfToken: csrfProtection(req, res) });
  });

  // ===== Protected Routes =====

  // Get current user
  app.get('/api/auth/me', requireAuth, (req: Request, res: Response) => {
    res.json({
      user: req.session.userData,
      sessionId: req.sessionID,
    });
  });

  // Logout endpoint
  app.post('/api/auth/logout', (req: Request, res: Response) => {
    req.session.destroy((err) => {
      if (err) {
        return res.status(500).json({ error: 'Logout failed' });
      }

      // Clear session cookie
      res.clearCookie('sessionId', {
        httpOnly: true,
        secure: process.env.NODE_ENV === 'production',
        sameSite: 'strict',
        path: '/',
      });

      res.json({ message: 'Logout successful' });
    });
  });

  // Protected resource example
  app.get('/api/protected-resource', requireAuth, (req: Request, res: Response) => {
    res.json({
      message: 'This is a protected resource',
      accessedBy: req.session.userData?.username,
      timestamp: new Date().toISOString(),
    });
  });

  // Health check
  app.get('/health', (req: Request, res: Response) => {
    res.json({ status: 'healthy' });
  });

  return app;
};

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.web.SecurityFilterChain;
import org.springframework.web.bind.annotation.*;
import jakarta.servlet.http.*;
import java.util.Map;

@RestController
@RequestMapping("/api/auth")
public class AuthController {

    private final UserService userService;

    public AuthController(UserService userService) {
        this.userService = userService;
    }

    @PostMapping("/register")
    public ResponseEntity<?> register(@RequestBody RegisterRequest body, HttpSession session) {
        if (!body.password().equals(body.confirmPassword()))
            return ResponseEntity.badRequest().body(Map.of("error", "Passwords do not match"));
        if (body.password().length() < 8)
            return ResponseEntity.badRequest().body(Map.of("error", "Password too short"));

        User user = userService.createUser(body.username(), body.email(), body.password());
        session.setAttribute("userId",    user.id());
        session.setAttribute("loginTime", System.currentTimeMillis());

        return ResponseEntity.status(201).body(Map.of(
            "message", "User created successfully",
            "user",    Map.of("id", user.id(), "username", user.username(), "email", user.email())
        ));
    }

    @PostMapping("/login")
    public ResponseEntity<?> login(
        @RequestBody LoginRequest body,
        HttpServletRequest request,
        HttpServletResponse response
    ) {
        User user = userService.verifyCredentials(body.email(), body.password());
        if (user == null)
            return ResponseEntity.status(401).body(Map.of("error", "Invalid credentials"));

        // Invalidate old session and create a new one (prevent fixation)
        request.getSession(false);
        request.getSession().invalidate();
        HttpSession newSession = request.getSession(true);

        newSession.setAttribute("userId",    user.id());
        newSession.setAttribute("loginTime", System.currentTimeMillis());

        if (Boolean.TRUE.equals(body.rememberMe()))
            newSession.setMaxInactiveInterval(7 * 24 * 60 * 60); // 7 days

        return ResponseEntity.ok(Map.of(
            "message", "Login successful",
            "user",    Map.of("id", user.id(), "username", user.username(), "email", user.email())
        ));
    }

    @PostMapping("/logout")
    public ResponseEntity<?> logout(HttpServletRequest request, HttpServletResponse response) {
        HttpSession session = request.getSession(false);
        if (session != null) session.invalidate();

        // Clear cookie
        Cookie cookie = new Cookie("sessionId", "");
        cookie.setMaxAge(0);
        cookie.setPath("/");
        cookie.setHttpOnly(true);
        cookie.setSecure(true);
        response.addCookie(cookie);

        return ResponseEntity.ok(Map.of("message", "Logout successful"));
    }

    @GetMapping("/me")
    public ResponseEntity<?> getMe(HttpSession session) {
        String userId = (String) session.getAttribute("userId");
        if (userId == null)
            return ResponseEntity.status(401).body(Map.of("error", "Not authenticated"));

        return userService.getUserById(userId)
            .map(u -> ResponseEntity.ok(Map.of(
                "user", Map.of("id", u.id(), "username", u.username(), "email", u.email()),
                "sessionId", session.getId()
            )))
            .orElseGet(() -> ResponseEntity.status(404).body(Map.of("error", "User not found")));
    }
}

import secrets
import json
from datetime import datetime, timezone
from fastapi import FastAPI, Request, Response, HTTPException, Depends
from pydantic import BaseModel

app = FastAPI()

# --- Request models ---

class RegisterRequest(BaseModel):
    username: str
    email: str
    password: str
    confirm_password: str

class LoginRequest(BaseModel):
    email: str
    password: str
    remember_me: bool = False

# --- Auth dependency ---

async def require_auth(request: Request) -> dict:
    session_id = request.cookies.get("sessionId")
    if not session_id:
        raise HTTPException(status_code=401, detail="Not authenticated")
    session = await get_session(session_id)
    if not session or "user_id" not in session:
        raise HTTPException(status_code=401, detail="Not authenticated")
    return session

# --- Routes ---

@app.post("/api/auth/register", status_code=201)
async def register(body: RegisterRequest, response: Response):
    if body.password != body.confirm_password:
        raise HTTPException(status_code=400, detail="Passwords do not match")
    if len(body.password) < 8:
        raise HTTPException(status_code=400, detail="Password must be at least 8 characters")

    user       = await UserService.create_user(body.username, body.email, body.password)
    session_id = secrets.token_hex(32)
    await save_session(session_id, {"user_id": user.id, "login_time": datetime.now(timezone.utc).timestamp()})

    response.set_cookie("sessionId", session_id, httponly=True, secure=True,
                        samesite="strict", max_age=86400)
    return {"message": "User created successfully",
            "user": {"id": user.id, "username": user.username, "email": user.email}}

@app.post("/api/auth/login")
async def login(body: LoginRequest, response: Response):
    user = await UserService.verify_credentials(body.email, body.password)
    if not user:
        raise HTTPException(status_code=401, detail="Invalid credentials")

    session_id = secrets.token_hex(32)
    ttl        = 7 * 24 * 60 * 60 if body.remember_me else 24 * 60 * 60
    await save_session(session_id, {"user_id": user.id, "login_time": datetime.now(timezone.utc).timestamp()})

    response.set_cookie("sessionId", session_id, httponly=True, secure=True,
                        samesite="strict", max_age=ttl)
    return {"message": "Login successful",
            "user": {"id": user.id, "username": user.username, "email": user.email}}

@app.post("/api/auth/logout")
async def logout(request: Request, response: Response):
    session_id = request.cookies.get("sessionId")
    if session_id:
        await delete_session(session_id)
    response.delete_cookie("sessionId", path="/", secure=True, httponly=True, samesite="strict")
    return {"message": "Logout successful"}

@app.get("/api/auth/me")
async def get_me(session: dict = Depends(require_auth)):
    user = await UserService.get_user_by_id(session["user_id"])
    if not user:
        raise HTTPException(status_code=404, detail="User not found")
    return {"user": {"id": user.id, "username": user.username, "email": user.email}}

using Microsoft.AspNetCore.Mvc;
using Microsoft.AspNetCore.Http;

[ApiController]
[Route("api/auth")]
public class AuthController : ControllerBase
{
    private readonly UserService _userService;

    public AuthController(UserService userService)
    {
        _userService = userService;
    }

    [HttpPost("register")]
    public async Task<IActionResult> Register([FromBody] RegisterRequest body)
    {
        if (body.Password != body.ConfirmPassword)
            return BadRequest(new { error = "Passwords do not match" });
        if (body.Password.Length < 8)
            return BadRequest(new { error = "Password must be at least 8 characters" });

        var user = await _userService.CreateUserAsync(body.Username, body.Email, body.Password);

        HttpContext.Session.SetString("userId",    user.Id);
        HttpContext.Session.SetString("loginTime", DateTimeOffset.UtcNow.ToUnixTimeMilliseconds().ToString());

        return StatusCode(201, new { message = "User created successfully",
            user = new { user.Id, user.Username, user.Email } });
    }

    [HttpPost("login")]
    public async Task<IActionResult> Login([FromBody] LoginRequest body)
    {
        var user = await _userService.VerifyCredentialsAsync(body.Email, body.Password);
        if (user is null)
            return Unauthorized(new { error = "Invalid credentials" });

        // Regenerate session to prevent fixation
        HttpContext.Session.Clear();

        HttpContext.Session.SetString("userId",    user.Id);
        HttpContext.Session.SetString("loginTime", DateTimeOffset.UtcNow.ToUnixTimeMilliseconds().ToString());

        if (body.RememberMe)
        {
            // Extend cookie lifetime (configure in session options)
            Response.Cookies.Append("sessionId", HttpContext.Session.Id, new CookieOptions
            {
                HttpOnly = true,
                Secure   = true,
                SameSite = SameSiteMode.Strict,
                MaxAge   = TimeSpan.FromDays(7),
            });
        }

        return Ok(new { message = "Login successful",
            user = new { user.Id, user.Username, user.Email } });
    }

    [HttpPost("logout")]
    public IActionResult Logout()
    {
        HttpContext.Session.Clear();
        Response.Cookies.Delete("sessionId", new CookieOptions
        {
            HttpOnly = true,
            Secure   = true,
            SameSite = SameSiteMode.Strict,
            Path     = "/",
        });
        return Ok(new { message = "Logout successful" });
    }

    [HttpGet("me")]
    public async Task<IActionResult> GetMe()
    {
        var userId = HttpContext.Session.GetString("userId");
        if (userId is null) return Unauthorized(new { error = "Not authenticated" });

        var user = await _userService.GetUserByIdAsync(userId);
        if (user is null) return NotFound(new { error = "User not found" });

        return Ok(new { user = new { user.Id, user.Username, user.Email },
            sessionId = HttpContext.Session.Id });
    }
}

// src/server.ts
import { createApp } from './app';
import { initializeRedis } from './config/sessionConfig';

const PORT = process.env.PORT || 3000;

const startServer = async () => {
  try {
    // Initialize Redis connection
    await initializeRedis();
    console.log('Redis connection established');

    // Create and start Express app
    const app = createApp();

    app.listen(PORT, () => {
      console.log(`Server running on port ${PORT}`);
      console.log(`Environment: ${process.env.NODE_ENV || 'development'}`);
    });
  } catch (error) {
    console.error('Failed to start server:', error);
    process.exit(1);
  }
};

startServer();

import org.springframework.boot.SpringApplication;
import org.springframework.boot.autoconfigure.SpringBootApplication;

@SpringBootApplication
public class Application {
    public static void main(String[] args) {
        // Spring Boot auto-configures Redis, session store, and embedded Tomcat.
        // Redis connection is validated at startup via LettuceConnectionFactory.
        SpringApplication.run(Application.class, args);
    }
}

import uvicorn
import asyncio

async def main():
    # Verify Redis connectivity before accepting requests
    await redis_client.ping()
    print("Redis connection established")

    config = uvicorn.Config(
        app,
        host="0.0.0.0",
        port=int(os.getenv("PORT", 3000)),
        log_level="info",
    )
    server = uvicorn.Server(config)
    await server.serve()

if __name__ == "__main__":
    asyncio.run(main())

// Program.cs — startup is handled by the WebApplication builder
// (see Session Configuration section above)
// The app.Run() call starts Kestrel on the configured port.

// To verify Redis on startup, add a health check:
builder.Services.AddHealthChecks()
    .AddRedis(
        builder.Configuration.GetConnectionString("Redis")!,
        name: "redis");

var app = builder.Build();
app.MapHealthChecks("/health");
app.Run();

// src/config/sessionConfig.ts (extended)
export const redisClient = createClient({
  url: process.env.REDIS_URL || 'redis://localhost:6379',
  password: process.env.REDIS_PASSWORD,
  socket: {
    reconnectStrategy: (retries) => {
      if (retries > 10) {
        console.error('Redis reconnection failed');
        process.exit(1);
      }
      return Math.min(retries * 100, 3000); // Cap at 3 seconds
    },
    connectTimeout: 10000,
    keepAlive: 30000,
    noDelay: true, // Disable Nagle's algorithm for lower latency
  },
});

// Enable Redis authentication and TLS in production
if (process.env.NODE_ENV === 'production') {
  // Handled via REDIS_URL with format: redis://username:password@host:port
}

@Bean
public LettuceConnectionFactory productionRedisFactory() {
    RedisStandaloneConfiguration cfg = new RedisStandaloneConfiguration();
    cfg.setHostName(System.getenv("REDIS_HOST"));
    cfg.setPort(Integer.parseInt(System.getenv().getOrDefault("REDIS_PORT", "6379")));
    if (System.getenv("REDIS_PASSWORD") != null)
        cfg.setPassword(System.getenv("REDIS_PASSWORD"));

    LettuceClientConfiguration clientCfg = LettuceClientConfiguration.builder()
        .commandTimeout(Duration.ofSeconds(10))
        .shutdownTimeout(Duration.ZERO)
        .build();

    return new LettuceConnectionFactory(cfg, clientCfg);
}

import redis.asyncio as aioredis
import os

redis_client = aioredis.from_url(
    os.environ["REDIS_URL"],
    password         = os.getenv("REDIS_PASSWORD"),
    socket_timeout   = 10,
    socket_keepalive = True,
    retry_on_timeout = True,
    health_check_interval = 30,
)

builder.Services.AddStackExchangeRedisCache(options =>
{
    options.Configuration = builder.Configuration.GetConnectionString("Redis");
    // Redis URL format: host:port,password=xxx,ssl=true,connectTimeout=10000
});

// For HA with Sentinel:
// options.Configuration = "sentinel-host:26379,serviceName=mymaster,password=xxx";

// Example: connect-mongo for MongoDB
import MongoStore from 'connect-mongo';

store: new MongoStore({
  mongoUrl: process.env.MONGODB_URI,
  touchAfter: 24 * 3600, // Lazy session update (every 24 hours)
})

// Spring Session with JPA (PostgreSQL / any relational DB)
// Add dependency: spring-session-jdbc

@Configuration
@EnableJdbcHttpSession(maxInactiveIntervalInSeconds = 86400)
public class JdbcSessionConfig {
    // Spring auto-creates the SPRING_SESSION table on first run
    // (or use the provided schema SQL for production)
}

# SQLAlchemy-backed session store (PostgreSQL / SQLite)
# Use sqlalchemy-session or a custom implementation

import sqlalchemy as sa
from sqlalchemy.ext.asyncio import AsyncSession

# Store session in a `sessions` table:
# CREATE TABLE sessions (
#   id VARCHAR PRIMARY KEY,
#   data JSONB,
#   expires_at TIMESTAMPTZ
# );

async def save_session_db(session_id: str, data: dict, ttl: int, db: AsyncSession):
    import json
    from datetime import datetime, timedelta, timezone
    expires_at = datetime.now(timezone.utc) + timedelta(seconds=ttl)
    await db.execute(
        sa.text("INSERT INTO sessions (id, data, expires_at) VALUES (:id, :data, :exp) "
                "ON CONFLICT (id) DO UPDATE SET data = :data, expires_at = :exp"),
        {"id": session_id, "data": json.dumps(data), "exp": expires_at},
    )

// ASP.NET Core with Entity Framework Core session store
// Add dependency: Microsoft.AspNetCore.Session (already included)
// For database-backed sessions, use a custom IDistributedCache backed by EF:

builder.Services.AddDbContext<SessionDbContext>(opts =>
    opts.UseNpgsql(builder.Configuration.GetConnectionString("Postgres")));

builder.Services.AddDistributedSqlServerCache(options =>
{
    options.ConnectionString = builder.Configuration.GetConnectionString("SqlServer");
    options.SchemaName       = "dbo";
    options.TableName        = "Sessions";
});

// All servers point to same Redis instance
store: new RedisStore({
  client: redisClient,
  prefix: 'session:', // Namespace sessions
})

// For Redis HA, use Redis Sentinel or Cluster
const redisClient = createClient({
  url: 'redis-sentinel://localhost:26379',
  // Or for cluster:
  // url: 'redis-cluster://localhost:7000,localhost:7001,localhost:7002'
});

// All Spring Boot instances share the same Redis session store
// configured via @EnableRedisHttpSession (see Session Configuration above).

// For Redis Sentinel HA:
@Bean
public LettuceConnectionFactory sentinelRedisFactory() {
    RedisSentinelConfiguration sentinelCfg = new RedisSentinelConfiguration()
        .master("mymaster")
        .sentinel("sentinel1", 26379)
        .sentinel("sentinel2", 26379);
    return new LettuceConnectionFactory(sentinelCfg);
}

# All FastAPI instances share the same Redis session store
# (redis_client defined in sessionConfig points to shared Redis)

# For Redis Sentinel:
redis_client = aioredis.from_url(
    "redis://sentinel1:26379,sentinel2:26379/0?sentinel=mymaster"
)

# For Redis Cluster:
from redis.asyncio.cluster import RedisCluster
redis_client = RedisCluster.from_url("redis://cluster-node1:7000")

// All ASP.NET Core instances use the same Redis cache for sessions.
// Configure via connection string in appsettings.json:
// "Redis": "node1:6379,node2:6379,node3:6379,abortConnect=false"

// For Sentinel:
builder.Services.AddStackExchangeRedisCache(options =>
{
    options.ConfigurationOptions = new ConfigurationOptions
    {
        EndPoints        = { "sentinel1:26379", "sentinel2:26379" },
        ServiceName      = "mymaster",
        AbortOnConnectFail = false,
    };
});

import csrf from 'csurf';

const csrfProtection = csrf({ cookie: false });

// Server generates token
app.get('/api/csrf-token', csrfProtection, (req, res) => {
  res.json({ csrfToken: csrfProtection(req, res) });
});

// Client includes token in form
app.post('/api/protected-action', csrfProtection, (req, res) => {
  // Token is validated automatically by csrf middleware
  // Request is rejected if token is missing or invalid
  res.json({ success: true });
});

import org.springframework.security.web.csrf.*;

// Spring Security provides CSRF protection out-of-the-box.
// Enable it in SecurityConfig (it is ON by default for stateful apps):

@Bean
public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
    http
        .csrf(csrf -> csrf
            .csrfTokenRepository(CookieCsrfTokenRepository.withHttpOnlyFalse())
            // or: .csrfTokenRepository(HttpSessionCsrfTokenRepository())
        );
    return http.build();
}

// Client must include X-XSRF-TOKEN header (or _csrf field) in mutating requests.
// Spring Security rejects requests with missing/invalid CSRF tokens automatically.

from fastapi import Request, HTTPException
import secrets

CSRF_TOKEN_KEY = "csrf_token"

async def get_csrf_token(request: Request) -> str:
    """Return (or create) a CSRF token stored in the session."""
    session_id = request.cookies.get("sessionId")
    if not session_id:
        raise HTTPException(status_code=401, detail="Not authenticated")
    session = await get_session(session_id)
    if CSRF_TOKEN_KEY not in session:
        session[CSRF_TOKEN_KEY] = secrets.token_hex(32)
        await save_session(session_id, session)
    return session[CSRF_TOKEN_KEY]

async def verify_csrf(request: Request) -> None:
    """Raise 403 if the CSRF token in the request header does not match the session."""
    session_id = request.cookies.get("sessionId")
    session    = await get_session(session_id or "")
    expected   = session.get(CSRF_TOKEN_KEY) if session else None
    received   = request.headers.get("X-CSRF-Token")
    if not expected or not secrets.compare_digest(expected, received or ""):
        raise HTTPException(status_code=403, detail="CSRF token validation failed")

@app.get("/api/csrf-token")
async def csrf_token_endpoint(request: Request):
    token = await get_csrf_token(request)
    return {"csrfToken": token}

@app.post("/api/protected-action")
async def protected_action(request: Request, _=Depends(verify_csrf)):
    return {"success": True}

// ASP.NET Core includes built-in CSRF (Antiforgery) support.

builder.Services.AddAntiforgery(options =>
{
    options.HeaderName  = "X-CSRF-Token";
    options.Cookie.Name = "XSRF-TOKEN";
});

// In controllers:
[ApiController]
public class CsrfController : ControllerBase
{
    private readonly IAntiforgery _antiforgery;

    public CsrfController(IAntiforgery antiforgery)
    {
        _antiforgery = antiforgery;
    }

    [HttpGet("api/csrf-token")]
    public IActionResult GetToken()
    {
        var tokens = _antiforgery.GetAndStoreTokens(HttpContext);
        return Ok(new { csrfToken = tokens.RequestToken });
    }

    [HttpPost("api/protected-action")]
    [ValidateAntiForgeryToken]  // Automatically validates X-CSRF-Token header
    public IActionResult ProtectedAction()
    {
        return Ok(new { success = true });
    }
}

// src/middleware/csrf.ts
import csrf from 'csurf';
import { Request, Response, NextFunction } from 'express';

export const csrfProtection = csrf({ cookie: false });

export const csrfErrorHandler = (
  err: any,
  req: Request,
  res: Response,
  next: NextFunction
) => {
  if (err.code === 'EBADCSRFTOKEN') {
    res.status(403).json({ error: 'CSRF token validation failed' });
  } else {
    next(err);
  }
};

// Usage in app
app.use(csrfErrorHandler);

// Get token endpoint
app.get('/api/csrf-token', csrfProtection, (req, res) => {
  res.json({ csrfToken: req.csrfToken() });
});

// Protected endpoints
app.post('/api/sensitive-action', csrfProtection, (req, res) => {
  // CSRF token is automatically validated
  res.json({ message: 'Action completed safely' });
});

import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.web.csrf.*;

@Configuration
public class CsrfConfig {

    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
        http
            .csrf(csrf -> csrf
                .csrfTokenRepository(CookieCsrfTokenRepository.withHttpOnlyFalse())
                .csrfTokenRequestHandler(new CsrfTokenRequestAttributeHandler())
            )
            .exceptionHandling(ex -> ex
                .accessDeniedHandler((req, res, accessDeniedException) -> {
                    if (accessDeniedException.getMessage().contains("CSRF")) {
                        res.setStatus(403);
                        res.getWriter().write("{\"error\":\"CSRF token validation failed\"}");
                    }
                })
            );
        return http.build();
    }
}

@RestController
public class CsrfController {

    @GetMapping("/api/csrf-token")
    public ResponseEntity<?> getCsrfToken(CsrfToken token) {
        return ResponseEntity.ok(Map.of("csrfToken", token.getToken()));
    }

    @PostMapping("/api/sensitive-action")
    public ResponseEntity<?> sensitiveAction() {
        // Spring Security validates X-XSRF-TOKEN automatically
        return ResponseEntity.ok(Map.of("message", "Action completed safely"));
    }
}