session

Builds an AuthenticationStrategy.Sync for session-based authentication.

Assign the result to http.authentication. Nothing is required — SessionConfig.sessionManager defaults to HttpSessionManager.of. Keep a reference to your SessionManager and call SessionManager.create / SessionManager.invalidate from login/logout handlers; the strategy only validates sessions on each request. To use SessionAuthenticator directly, call SessionAuthenticator.builder and wrap it in a custom AuthenticationStrategy.Sync (or AuthenticationStrategy.sync).