This is now supported in v1.2.0 !

I've looked through the next-iron-session repository to see how they handle secret rotation and liked the approach.
You can find more clear instructions to setup password rotation in the README

from svelte-kit-cookie-session.

Looks really good, thanks! Having a list is more flexible than the previousSecret I had suggested, since it would allow things like rotating secrets every day while keeping a 7-day expiration. (Which is more paranoid than my use case needs, but some people might need that).

The only thing I'd change about the implementation is that if a session cookie shows up with an ID not in the list, I'd prefer for the session to be destroyed rather than an error thrown. Because the most likely scenario where a cookie shows up with an invalid secret ID is when a secret was rotated out before that session expired, maybe because the secret was leaked (:scream: indeed). I'd much rather have that be treated the same as a session that timed out, rather than have to catch an exception and then figure out what happened to throw that exception.

Apart from that one quibble, thanks for a speedy implementation!

from svelte-kit-cookie-session.

That's a good point i haven't thought of. Thanks for your request! I will try to get it in shortly.

from svelte-kit-cookie-session.