Session-based authentication design #4

New issue

Open

opened 2026-08-23 11:16:48 +02:00 by gaetan · 0 comments

gaetan commented

2026-08-23 11:16:48 +02:00

Owner

Part of #1

Question

Design the session-based authentication for this single-user app. Key decisions:

Password storage: Argon2id (via golang.org/x/crypto/argon2) — standard, secure
Session storage: In-memory (lost on restart) vs SQLite (persists, supports concurrent sessions)
Session lifetime: How long before a session expires? (e.g. 30 days, 90 days, never?)
Login flow: Simple form (username + password) → session cookie. What's the username? (Probably just "admin" or configurable)
Cookie attributes: httpOnly, secure (if behind HTTPS), same-site
Multiple sessions: Can the same user be logged in on multiple devices?

Since it's single-user, we don't need user management — just one account.

Part of #1 ## Question Design the session-based authentication for this single-user app. Key decisions: - **Password storage**: Argon2id (via `golang.org/x/crypto/argon2`) — standard, secure - **Session storage**: In-memory (lost on restart) vs SQLite (persists, supports concurrent sessions) - **Session lifetime**: How long before a session expires? (e.g. 30 days, 90 days, never?) - **Login flow**: Simple form (username + password) → session cookie. What's the username? (Probably just "admin" or configurable) - **Cookie attributes**: httpOnly, secure (if behind HTTPS), same-site - **Multiple sessions**: Can the same user be logged in on multiple devices? Since it's single-user, we don't need user management — just one account.

gaetan added the

wayfinder:grilling

label

2026-08-23 11:16:48 +02:00