Session Configuration

このページは、まだ日本語ではご利用いただけません。翻訳中です。

古いプラグインバージョンのドキュメントを閲覧しています。

構成

このプラグインはDB-lessモードと部分的に互換性があります。

config.storage must be set to cookie. The kong strategy uses a database, and is not supported. The plugin currently lacks checks for this invalid configuration in DB-less mode.

互換性のあるプロトコル

Sessionプラグインは以下のプロトコルに対応しています：

grpc, grpcs, http, https, tcp, tls, tls_passthrough, udp, ws, wss

パラメータ

このプラグインの設定で使用できるすべてのパラメータのリストは次のとおりです。

• name or plugin

  string required

  プラグイン名。この場合は session 。

  • Kong Admin API、Kong Konnect API、宣言型構成、または decK ファイルを使用する場合、フィールドはnameです。
  • Kubernetes で KongPlugin オブジェクトを使用する場合、フィールドはpluginです。

• instance_name

  string

  プラグインのインスタンスを識別するための任意のカスタム名 (例: session_my-service 。

  インスタンス名はKong ManagerとKonnectに表示されるので、 例えば複数のサービスで同じプラグインを複数のコンテキストで実行する場合に便利です。また、Kong Admin API経由で特定のプラグインインスタンスに アクセスするためにも使用できます。

  インスタンス名は、次のコンテキスト内で一意である必要があります。

  • Kong Gateway Enterpriseのワークスペース内
  • Konnectのコントロールプレーン（CP）またはコントロールプレーン（CP）グループ内
  • Kong Gateway (OSS)の全世界

• service.name or service.id

  string

  プラグインが対象とするサービス名または ID。最上位の /plugins エンドポイント. からプラグインをサービスに追加する場合は、これらのパラメータのいずれかを設定してください /services/{serviceName|Id}/plugins を使用する場合は必要ありません。

• route.name or route.id

  string

  プラグインがターゲットとするルート名または ID。最上位の /plugins エンドポイント. を通るルートにプラグインを追加する場合は、これらのパラメータのいずれかを設定してください /routes/{routeName|Id}/plugins を使用する場合は必要ありません。

• enabled

  boolean default: true

  このプラグインが適用されるかどうか。

• config

  record required
  • secret

    string referenceable encrypted default: beRbEfhfh8hVrEdj5Qmbt4xkUVH2ZCtKf9FPbRQBhLww

    The secret that is used in keyed HMAC generation.

  • storage

    string default: cookie Must be one of: cookie, kong

    Determines where the session data is stored. kong: Stores encrypted session data into Kong’s current database strategy; the cookie will not contain any session data. cookie: Stores encrypted session data within the cookie itself.

  • audience

    string default: default

    The session audience, which is the intended target application. For example "my-application".

  • idling_timeout

    number default: 900

    The session cookie idle time, in seconds.

  • rolling_timeout

    number default: 3600

    The session cookie rolling timeout, in seconds. Specifies how long the session can be used until it needs to be renewed.

  • absolute_timeout

    number default: 86400

    The session cookie absolute timeout, in seconds. Specifies how long the session can be used until it is no longer valid.

  • stale_ttl

    number default: 10

    The duration, in seconds, after which an old cookie is discarded, starting from the moment when the session becomes outdated and is replaced by a new one.

  • cookie_name

    string default: session

    The name of the cookie.

  • cookie_path

    string default: /

    The resource in the host where the cookie is available.

  • cookie_domain

    string

    The domain with which the cookie is intended to be exchanged.

  • cookie_same_site

    string default: Strict Must be one of: Strict, Lax, None, Default

    Determines whether and how a cookie may be sent with cross-site requests.

    • Strict: The browser sends cookies only if the request originated from the website that set the cookie.
    • Lax: Same-site cookies are withheld on cross-domain subrequests, but are sent when a user navigates to the URL from an external site, for example, by following a link.
    • None or off: Disables the same-site attribute so that a cookie may be sent with cross-site requests. None requires the Secure attribute (cookie_secure) in latest browser versions. For more info, see the SameSite cookies docs on MDN.

  • cookie_http_only

    boolean default: true

    Applies the HttpOnly tag so that the cookie is sent only to a server. See the Restrict access to cookies docs on MDN.

  • cookie_secure

    boolean default: true

    Applies the Secure directive so that the cookie may be sent to the server only with an encrypted request over the HTTPS protocol. See the Restrict access to cookies docs on MDN.

  • remember

    boolean default: false

    Enables or disables persistent sessions.

  • remember_cookie_name

    string default: remember

    Persistent session cookie name. Use with the remember configuration parameter.

  • remember_rolling_timeout

    number default: 604800

    The persistent session rolling timeout window, in seconds.

  • remember_absolute_timeout

    number default: 2592000

    The persistent session absolute timeout limit, in seconds.

  • response_headers

    set of type string Must be one of: id, audience, subject, timeout, idling-timeout, rolling-timeout, absolute-timeout

    List of information to include, as headers, in the response to the downstream.

    Accepted values are: id, audience, subject, timeout, idling-timeout, rolling-timeout, and absolute-timeout.

    For example: { "id", "timeout" } injects both Session-Id and Session-Timeout in the response headers.

  • request_headers

    set of type string Must be one of: id, audience, subject, timeout, idling-timeout, rolling-timeout, absolute-timeout

    List of information to include, as headers, in the request to the upstream.

    Accepted values are: id, audience, subject, timeout, idling-timeout, rolling-timeout, and absolute-timeout.

    For example, { "id", "timeout" } sets both Session-Id and Session-Timeout in the request headers.

  • logout_methods

    set of type string default: POST, DELETE Must be one of: GET, POST, DELETE

    The methods that may be used to end sessions: POST, DELETE, GET.

  • logout_query_arg

    string default: session_logout

    The query argument passed to logout requests.

  • logout_post_arg

    string default: session_logout

    The POST argument passed to logout requests. Do not change this property.

• cookie_lifetime

  number
  Deprecation notice: This field has been deprecated and will be removed in a future version..

• cookie_idletime

  number
  Deprecation notice: This field has been deprecated and will be removed in a future version..

• cookie_renew

  number
  Deprecation notice: This field has been deprecated and will be removed in a future version..

• cookie_discard

  number
  Deprecation notice: This field has been deprecated and will be removed in a future version..

• cookie_samesite

  string
  Deprecation notice: This field has been deprecated and will be removed in a future version..

• cookie_httponly

  boolean
  Deprecation notice: This field has been deprecated and will be removed in a future version..

• cookie_persistent

  boolean
  Deprecation notice: This field has been deprecated and will be removed in a future version..