nic-6443 commented on PR #13178:
URL: https://github.com/apache/apisix/pull/13178#issuecomment-4660205285
@francescodedomenico glad you're keen on this — I think we're closer than it
sounds, but let me clear up one thing, because I suspect a version-number
mix-up.
When I wrote "3.x" and "4.x" I meant the **lua-resty-session library**
versions, not APISIX versions. #12862 bumped the bundled lua-resty-session from
`3.10` to `4.1.5`, and the flat `cookie_*` / `*_timeout` keys are simply that
library's 4.x config surface. None of this is tied to an APISIX major version.
And the key point: **the approach I proposed is not a breaking change** —
it's purely additive, so it can ship in APISIX 3.x. Nothing needs to wait for a
hypothetical APISIX 4.0:
- `session.cookie.lifetime` stays accepted (just marked deprecated) and is
mapped to `absolute_timeout`. Existing configs keep validating and keep working.
- The new flat keys (`cookie_name`, `cookie_secure`, `idling_timeout`, …)
are new optional properties. Nothing is removed, no types change, no new
required fields.
Concretely, both of these stay valid. Existing config — still works, and
`lifetime` now actually takes effect (that's the bug fix):
```json
{
"session": {
"secret": "jwcE5v3pM9VhqLxmxFOH9uZaLo8u7KQK",
"cookie": { "lifetime": 7200 }
}
}
```
New config — the flat lua-resty-session 4.x keys:
```json
{
"session": {
"secret": "jwcE5v3pM9VhqLxmxFOH9uZaLo8u7KQK",
"cookie_name": "oidc_session",
"cookie_path": "/app",
"cookie_same_site": "Strict",
"cookie_secure": true,
"absolute_timeout": 7200,
"idling_timeout": 600
}
}
```
On your point that APISIX shouldn't be opinionated about how the library is
used — I actually agree, and that's exactly why I suggested the flat names:
they're lua-resty-session's *own* config keys, with no remapping or aliasing in
between. The only difference from a full `additionalProperties` pass-through is
that we list the supported keys explicitly, so an unknown or misspelled key
fails validation instead of being silently dropped — which is precisely the
failure mode that let `cookie.lifetime` quietly stop working. You still get
direct access to the library's config; you just get it validated.
Once we agree on this shape, I'll help bring in the other maintainers to
review so the PR doesn't stall on the three-reviewer requirement. Does this
clear up the breaking-change concern? If so, I think you're good to update the
PR along these lines.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
