Sveltejs Academy · Lesson

Cookie-Based Sessions

Create and manage server-side sessions using secure HTTP-only cookies.

Lesson 1 of 413 steps

Cookie-Based Sessions is a free Sveltejs Academy lesson on CoddyKit. This is lesson 1 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Sveltejs Academy learning path, and your progress syncs across the web and the CoddyKit app. The Sveltejs Academy course includes 4 lessons in total.

Why Cookies

Cookies are the most reliable way to persist authentication across page loads, especially for SSR apps.

HTTP-Only

HTTP-only cookies cannot be read by JavaScript, preventing XSS theft of session tokens.

Secure and SameSite

Always set secure: true in production and sameSite: "lax" for CSRF mitigation.

Setting a Session Cookie

Use the cookies helper in an action or endpoint.

cookies.set("sessionId", sid, {
  path: "/",
  httpOnly: true,
  secure: true,
  sameSite: "lax",
  maxAge: 60 * 60 * 24 * 7
});

Reading the Session

Read the cookie inside hooks and resolve the session to a user object.

const sid = event.cookies.get("sessionId");
event.locals.user = await db.session.findUser(sid);

Logging Out

Delete the cookie to log out.

cookies.delete("sessionId", { path: "/" });

Server-Side Storage

Store session details (user id, expiry) in a database or fast cache (Redis).

Expiry and Renewal

Rotate session IDs periodically and after sensitive actions like password change.

CSRF Protection

SvelteKit prevents CSRF on form actions by default via origin checks.

HTTPS Only

Always serve sessions over HTTPS; cookies set with secure require it.

Refresh Tokens

For long-lived auth, combine a short session cookie with a longer refresh token.

Quick Check

Why use httpOnly cookies?

Answer it in the interactive lesson

Recap

Use httpOnly, secure, sameSite cookies set by the server, resolved to a user in hooks for SSR-friendly auth.

Free to start

Learn HTML with an AI tutor — free

Write and run real code in your browser, get instant help from a 24/7 AI tutor, and pick up where you left off on the web or in the app.

Courses: 41
Lessons: 163

Start learning free View the full course

Frequently Asked Questions

Is the “Cookie-Based Sessions” lesson free?

Yes — the full text of “Cookie-Based Sessions” is free to read here on the web. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Sveltejs Academy course, upgrade to CoddyKit PRO. The Sveltejs Academy course includes 4 lessons in total.

What will I learn in “Cookie-Based Sessions”?

Create and manage server-side sessions using secure HTTP-only cookies. You practise Sveltejs Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.

Do I need any experience to start Sveltejs Academy?

No prior experience is required. Sveltejs Academy on CoddyKit is structured for beginners through advanced learners, so you can start here or from the beginning and move at your own pace. This is lesson 1 of 4.

How long does the “Cookie-Based Sessions” lesson take?

Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.

Can I write and run code in this Sveltejs Academy lesson?

Yes. Every Sveltejs Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.

All lessons in this course

← Back to Sveltejs Academy