Kitto.Web.Routing.Session

Session provider interface abstracting the transport mechanism for session identification. Current implementation: cookie-based opaque id (TKXCookieSessionProvider).

Note: The JWT envelope (Auth: JWT, see Kitto.Auth.JWT and Kitto.Web.JWT) does NOT plug in here — it ships its own cookie (kx_token, HttpOnly+Secure+SameSite) and validates the signed token via the polymorphic TKAuthenticator.AuthorizeRequest hook called from TKWebApplication.DoHandleRequest. Session correlation for JWT apps reads the 'sid' claim inline from the engine's GetSessionIdFromRequest, with no dependency on this interface.

IKXSessionProvider interface

Abstraction for session ID transport. Implementations handle reading the session ID from requests and writing it to responses. The session state itself (TKWebSession) is unchanged.

function GetSessionId(const ARequest: TKWebRequest): string;

Extracts the session ID from the incoming request. Returns empty string if no session ID is present.

procedure SetSessionId(const AResponse: TKWebResponse;

Sets the session ID on the outgoing response (e.g., Set-Cookie header).

procedure RemoveSession(const AResponse: TKWebResponse);

Removes/invalidates the session ID on the outgoing response.

TKXCookieSessionProvider class

Cookie-based session provider. Reads and writes the session ID as an HTTP cookie. This is the current KittoX behavior.

constructor Create(const ACookieName: string = 'kx_session');

Creates the provider using the given cookie name (default 'kx_session').