Does Lucia support encrypted / signed cookies so we don't have to hit the database to validate a session?

[schwartzmj]

Does Lucia support encrypted / signed cookies so we don't have to hit the database to validate / get information about a session? Just making sure I'm not missing something in the docs.

[pilcrowonpaper]

Do you mean something like JWTs? Then, no - see #112

[schwartzmj]

To be clear, I'm talking about encrypting user information inside the cookie (user ID, user name, user email, etc). I intentionally didn't use the term JWT since the way they're normally used isn't exactly what I'm interested in.

It sounds like your reasoning against JWT was for authorization purposes which makes some sense, and while what I'm suggesting has the option of adding any additional arbitrary data to the session cookie (team ID, role, whatever), by default it would just tell you who the user is without having to hit the database.

Auth isn't my forte, so apologies if I'm misunderstanding anything. Appreciate the response.

[pilcrowonpaper]

One issue is that once a cookie is signed, it's valid forever. You can try to overwrite a cookie but there's nothing stopping someone from storing and reusing an old cookie. I'm also guessing you'll still need to store some user data as well.

[mubaidr]

But we can still verify sessions/ cookie at our will at times (I don't even know what would be standard here). And we can remove cookie from client by setting expiration time in the past.