Documentation / zerotal / session / RedisDriver

Class: RedisDriver

Defined in: packages/session/src/drivers/RedisDriver.ts:59

Redis-backed session driver.

The cookie holds the session ID; all session data lives in Redis under the key session:{id}. When a secret is provided the cookie value is HMAC-signed (id.signature) so forged IDs are rejected before a Redis lookup is ever attempted.

Security improvement over the unsigned version:

Forged/tampered session IDs are detected server-side in constant time via safeEqual (@zerotal/core, backed by node:crypto's timingSafeEqual) — no Redis round-trip required for rejection.
Uses Bun.CryptoHasher with BoringSSL — hardware-accelerated on supported CPUs, with zero npm packages.

Example

// Without signing (backwards compatible):
new RedisDriver(redis, 'session', 86400)

// With HMAC signing (recommended):
new RedisDriver(redis, 'session', 86400, Bun.env.SESSION_SECRET!)

See

SessionDriver — the interface this implements.

Implements

SessionDriver

Constructors

Constructor

new RedisDriver(redis, cookieName?, ttl?, secret?): RedisDriver

Defined in: packages/session/src/drivers/RedisDriver.ts:69

Parameters

redis

RedisClient

Connected Bun RedisClient used for storage.

cookieName?

string = "session"

Name of the cookie carrying the session ID. Defaults to "session".

ttl?

number = 86_400

Redis key TTL / cookie Max-Age in seconds. Defaults to 86400 (24h).

secret?

string

Optional HMAC secret; when set, cookie IDs are signed and verified before any Redis lookup. Omit to trust the raw cookie ID.

Returns

RedisDriver

Properties

cookieName

readonly cookieName: string = "session"

Defined in: packages/session/src/drivers/RedisDriver.ts:71

Name of the cookie carrying the session ID. Defaults to "session".

Methods

loadFromRequest()

loadFromRequest(request): Promise<SessionPayload>

Defined in: packages/session/src/drivers/RedisDriver.ts:82

Read the (optionally signed) session ID from the cookie, then load its data from Redis under session:{id}. A missing cookie, a failed signature, or an unparseable value all yield a session with empty data.