A Phoenix plug that generates and manages unique session IDs.

This plug creates a cryptographically secure, URL-safe session ID for each user session and stores it in the Plug session. The session ID is used to identify and manage the dedicated session process for each user.

Session ID Format

Session IDs are generated using:

• 24 bytes (192 bits) of cryptographically secure random data
• URL-safe Base64 encoding without padding
• Results in 32-character strings like: aBcDeFgHiJkLmNoPqRsTuVwXyZaBcDeFg

Integration

Add this plug after the :fetch_session plug in your router:

pipeline :browser do
  plug :accepts, ["html"]
  plug :fetch_session
  plug Phoenix.SessionProcess.SessionId  # Add this line
  # ... other plugs ...
end

Security Considerations

• Uses :crypto.strong_rand_bytes/1 for cryptographically secure randomness
• 192 bits of entropy provides excellent protection against guessing attacks
• URL-safe encoding ensures compatibility with web standards
• No padding removes potential trailing characters that could cause issues

Session Lifecycle

1. First request: Generates new session ID and stores in session
2. Subsequent requests: Retrieves existing session ID from session
3. Session ID is stored in the Plug session, retrieve with get_session(conn, :session_id)

Usage in Controllers

def index(conn, _params) do
  session_id = get_session(conn, :session_id)
  # Use session_id to start or communicate with session process
end