#
# Session configuration for the Flow Framework
#

Neos:
  Flow:
    session:

      # Specifies the number of seconds a user must be idle before the session
      # automatically expires. If set to "0", a session will never expire
      # automatically.
      inactivityTimeout: 3600

      # A specific name for the session, used in the session cookie.
      # The session name must be alphanumerical and must contain at least one
      # character – not only numbers.
      name: 'Neos_Flow_Session'

      # Configuration for handling of expired sessions
      garbageCollection:

        # The probability in percent of a session shutdown triggering a garbage
        # collection which removes expired session data from other sessions.
        #
        # Examples:
        #    1    (would be a 1% chance to clean up)
        #   20    (would be a 20% chance to clean up)
        #    0.42 (would be a 0.42 % chance to clean up)
        probability: 1

        # The number of invalid and expired sessions which are removed per garbage
        # collection run.
        maximumPerRun: 1000

      # Configuration for the session cookie:
      cookie:

        # Cookie lifetime in seconds
        # Note that if you want to sessions expire automatically, you should rather
        # set inactivityTimeout to the wanted value. Only in rare cases you'd want
        # some other cookie lifetime than "0".
        lifetime: 0

        # Cookie path: set this if a cookie should be only valid for a subfolder of a domain.
        path: /

        # Force SSL cookies.
        secure: false

        # Allow http access only.
        httponly: true

        # The cookie domain. Only denote the top-level domain if cookies should be valid for
        # all subdomains. Dot notation is not supported.
        #domain: domain.com
        domain: NULL

        # The cookie samesite.
        # possible values: 'none', 'strict' and 'lax'
        samesite: 'lax'
