Sessions and CSRF

Keep credentials on the server

Verify a stored password hash before creating a session. User tables, permissions and account policy belong to your application. The browser receives a signed HttpOnly session cookie, never a password hash.

Use a cryptographically random AX_SECRET_SESSION_KEY of at least 32 bytes. Keep it in deployment secrets, not source control or public state. Use Secure cookies and configure the external HTTPS origin behind a proxy.

[server]
public_origin = "https://your-domain.example"

Refresh is an explicit action

action RefreshSession() {
  require Auth.subject else redirect("/login")
  Session.refresh()
  return ok()
}

action Logout() {
  Session.destroy()
  return ok()
}

Refresh preserves the session ID and its CSRF proof. It extends sliding expiry only within the absolute lifetime. Expired or revoked sessions cannot be refreshed; GET, HEAD and OPTIONS cannot refresh through the backend runtime.

AX_SECRET_SESSION_TTL_SECONDS=86400
AX_SECRET_SESSION_ABSOLUTE_TTL_SECONDS=2592000

The absolute cap defaults to 30 days. Cookie Max-Age follows the remaining deadline. This is not JWT refresh or session-ID rotation.

Forms work without JavaScript

Framework-rendered local POST action forms receive a hidden __ax_csrf proof at HTTP delivery. Build artifacts contain only a placeholder. Personalized HTML is no-store and native submissions receive redirects rather than patch JSON.

Before login, browser mutations use a signed anonymous proof and a 30-minute HttpOnly cookie. Reload an expired anonymous form. After login, the active session proof takes precedence.

Browser API clients

Read a proof from GET /__axonyx/csrf with same-origin credentials, then send it in X-Axonyx-CSRF or the explicit __ax_csrf form/JSON field. Do not put proofs in URLs, logs or public snapshots. Missing or invalid proofs are rejected before the handler runs.

What this does not cover

Legacy signed-cookie auth, raw HTML forms and custom Rust servers need explicit integration. Metadata-free, cookie-free API clients retain their own authentication path; exemption is not authorization. Form-containing streams are buffered for token injection.

Password reset, email verification, MFA, distributed throttling and JWT refresh pairs are not included. CSRF protection does not prevent XSS or replace permission checks.