The JWT Token cannot be changed, but it can be read.

This implementation saves the JWT into a client cookie. Because of this, do not store sensible data like passwords in the session.

:::danger Never store sensitive information such as passwords, API keys, or personal identifiable information (PII) in the JWT session. The token is encoded but not encrypted when using shared secrets. :::

Always use HTTPS in production to prevent token interception during transmission.

• Never commit secret keys to version control
• Use environment variables to store secret keys
• Ensure secret keys are base64url encoded
• Rotate secret keys periodically

Set appropriate timeout values based on your application's security requirements:

// For high-security applications
->withTimeoutMinutes(15)

// For standard applications
->withTimeoutMinutes(60)

// For low-security or development environments
->withTimeoutHours(24)

When configuring cookies:

• Use specific domain paths to limit cookie scope
• Consider the domain scope carefully (.example.com vs example.com)

For applications requiring higher security, use RSA private/public keys instead of shared secrets:

->withRsaSecret($privateKey, $publicKey)

This provides:

• Asymmetric encryption
• Better key distribution security
• Enhanced protection against key compromise

• Session Fixation: New token generated on each write
• Server-side Storage Issues: No server-side session storage required
• Scaling Issues: Works seamlessly across multiple servers
• Token Tampering: JWT signature prevents token modification

• Token Theft: If an attacker obtains the cookie, they can use it
• XSS Attacks: Store only non-sensitive data in sessions
• Man-in-the-Middle: Always use HTTPS
• Token Content Privacy: Token payload is readable (use RSA for better protection)

The library throws JwtSessionException in the following cases:

• Invalid SessionConfig instance provided
• Session already started when trying to replace handler
• Invalid serialized session data format

Always implement proper exception handling in production code.