Agent skill · software engineering · aj-geddes
session-management
Implement secure session management systems with JWT tokens, session storage, token refresh, logout handling, and CSRF protection. Use when managing user authentication state, handling token lifecycle, and securing sessions.
Why this skill is useful
Provides domain-specific knowledge on secure session management practices and JWT handling that the AI wouldn't reliably generate on its own.
What it needs
About 2k tokens when loaded. Last updated 2026-03-04. 307 stars on the source repository.
What this skill does
Session Management Table of Contents Overview When to Use Quick Start Reference Guides Best Practices Overview Implement comprehensive session management systems with secure token handling, session persistence, token refresh mechanisms, proper logout procedures, and CSRF protection across different backend frameworks. When to Use Implementing user authentication systems Managing session state and user context Handling JWT token refresh cycles Implementing logout functionality Protecting against CSRF attacks Managing session expiration and cleanup Quick Start Minimal working example: Reference Guides Detailed implementations in the references/ directory: Guide Contents --- --- JWT Token Generation and Validation JWT Token Generation and Validation Node.js/Express JWT Implementation Node.js/Express JWT Implementation Session Storage with Redis Session Storage with Redis CSRF Protection CSRF Protection Session Middleware Chain Session Middleware Chain Token Refresh Endpoint Token Refresh Endpoint Session Cleanup and Maintenance Session Cleanup and Maintenance Best Practices ✅ DO Use HTTPS for all session transmission Implement secure cookies (httpOnly, sameSite, secure flags) Use JWT with proper expiration times Implement token refresh mechanism Store refresh tokens securely Validate tokens on every request Use strong secret keys Implement session timeout Log authentication events Clear session data on logout Use CSRF tokens for state-changing requests ❌ DON'T Store sensitive data in tokens Use short secret keys Transmit tokens in URLs Ignore token expiration Reuse token secrets across environments Store tokens in localStorage (use httpOnly cookies) Implement session without HTTPS Forget to validate token signatures Expose session IDs in logs Use predictable session IDs
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills aj-geddes/session-management