Hey everyone 👋

I recently published passport-cookie-session, a modern encrypted alternative to cookie-session, designed specifically to work seamlessly with PassportJS.

While the Passport docs still suggest using cookie-session, it's no longer maintained and lacks encryption — it only signs cookies, meaning session data is visible to clients.

This package aims to address that:

• 🔐 AES-256-GCM (or custom async) encryption
• 🔁 Key rotation support
• 💡 Built for PassportJS
• ⚡ Stateless and lightweight
• 🧪 Optional startup validation of custom crypto
• 🧠 Secure defaults + cookie size limit

If you're currently using cookie-session, I'd love for you to check this out. Feedback, issues all welcome!

📦 npm install passport-cookie-session

Thanks! 🚀