Skip to content

Commit 2ae9c85

Browse files
update migration guide
1 parent 2d46ed3 commit 2ae9c85

File tree

1 file changed

+17
-2
lines changed

1 file changed

+17
-2
lines changed

pages/sessions/migrate-lucia-v3.md

+17-2
Original file line numberDiff line numberDiff line change
@@ -6,8 +6,6 @@ title: "Migrate from Lucia v3"
66

77
Because Lucia v3 is lightweight and relatively low-level, migrating your project shouldn't take long. Moreover, most of your knowledge will still be very useful. No database migrations are necessary.
88

9-
The one change to how sessions work is that session tokens are now hashed before storage. The pre-hash token is the client-assigned session ID and the hash is the internal session ID. The easiest option would be to purge all existing sessions, but if you want keep existing sessions, SHA-256 and hex-encode the session IDs stored in the database. Or, you can skip the hashing altogether. Hashing is a good measure against database leaks, but not absolutely necessary.
10-
119
APIs on sessions are covered in the [Basic session API](/sessions/basic-api) page.
1210

1311
- `Lucia.createSession()` => `generateSessionToken()` and `createSession()`
@@ -19,4 +17,21 @@ APIs on cookies are covered in the [Session cookies](/sessions/cookies) page.
1917
- `Lucia.createSessionCookie()` => `setSessionTokenCookie()`
2018
- `Lucia.createBlankSessionCookie()` => `deleteSessionTokenCookie()`
2119

20+
The one change to how sessions work is that session tokens are now hashed before storage. The pre-hash token is the client-assigned session ID and the hash is the internal session ID. The easiest option would be to purge all existing sessions, but if you want keep existing sessions, SHA-256 and hex-encode the session IDs stored in the database. Or, you can skip the hashing altogether. Hashing is a good measure against database leaks, but not absolutely necessary.
21+
22+
```ts
23+
export function createSession(userId: number): Session {
24+
const bytes = new Uint8Array(20);
25+
crypto.getRandomValues(bytes);
26+
const sessionId = encodeBase32LowerCaseNoPadding(bytes);
27+
// Insert session into database.
28+
return session;
29+
}
30+
31+
export function validateSessionToken(sessionId: string): SessionValidationResult {
32+
// Get and validate session
33+
return { session, user };
34+
}
35+
```
36+
2237
If you need help or have any questions, please ask them on [Discord](https://discord.com/invite/PwrK3kpVR3) or on [GitHub discussions](https://github.com/lucia-auth/lucia/discussions).

0 commit comments

Comments
 (0)