Session Management for SSG/SSR Skill

When to Use This Skill

• User wants to implement session management in static sites (SSG)
• Need to handle authentication in server-side rendered applications (SSR)
• Looking for stateless authentication with JWT tokens
• Want to implement database session management in web applications
• Need to handle sessions across different rendering strategies (SSG/SSR/CSR)

How This Skill Works (Step-by-Step Execution)

1. Context Analysis

- Determine if application uses SSG, SSR, or CSR - Identify authentication requirements for each context - Plan session strategy based on rendering approach

1. Stateless Authentication Setup

- Implement JWT-based session management - Configure token generation and verification - Set up expiration and refresh mechanisms

1. Database Session Management

- Create session models for database storage - Implement session creation and validation - Add session cleanup and expiration handling

1. Client-Side Session Handling

- Implement token storage strategies (localStorage, cookies) - Create session state management - Add token refresh and renewal mechanisms

1. Security Implementation

- Configure proper session security headers - Implement secure token transmission - Add session hijacking prevention measures

Output You Will Receive

After activation, I will deliver:

• Complete session management strategy for your context
• JWT implementation for stateless sessions
• Database session models and management
• Client-side session handling code
• Security best practices for session management
• Context-specific implementation guides

Example Usage

User says: "I have a Next.js app with SSG and need to implement session management."

This Skill Instantly Activates → Delivers:

• JWT-based authentication strategy for static sites
• Client-side session management with token storage
• Server-side verification for API routes
• Session persistence across page navigations
• Security best practices for SSG contexts

User says: "Implement session management in my SSR application."

This Skill Responds: → Creates database session management approach → Implements server-side session validation → Adds client-side session synchronization → Provides security headers configuration → Sets up session cleanup and expiration

Activate This Skill By Saying

• "Add session management to my SSG app"
• "Implement sessions in my SSR application"
• "JWT session management for static sites"
• "Database session management for web apps"

Core Implementation Steps

1. Database Session Model (SQLModel/SQLAlchemy)

from sqlmodel import SQLModel, Field, Session
from typing import Optional

class Session(SQLModel, table=True):
    id: Optional[int] = Field(default=None, primary_key=True)
    user_id: str
    session_token: str
    expires_at: datetime
    created_at: datetime
    ip_address: str
    user_agent: str

2. Session Management Explanation

Session = database connection wrapper that:
- Opens DB connection
- Sends queries
- Manages transactions
- Commits or rolls back
- Closes automatically

Usage:
with Session(engine) as session:
  # Open connection
  # Use during request
  # Auto-close after request

Why sessions are needed:
- Transaction safety
- Prevents connection leaks
- Handles commit / rollback
- Isolates each request

Rule: 1 request = 1 DB session

3. JWT Stateless Session (Frontend)

// Store JWT token in localStorage
localStorage.setItem('auth_token', jwt_token);

// Include in API requests
fetch('/api/protected', {
  headers: {
    'Authorization': `Bearer ${localStorage.getItem('auth_token')}`
  }
});

4. Session Validation (Backend)

from fastapi import Depends, HTTPException
from fastapi.security import HTTPBearer

security = HTTPBearer()

def validate_session(token: str = Depends(security)):
    # Verify JWT token or check database session
    # Return user info if valid
    pass

@app.get("/protected")
def protected_route(user = Depends(validate_session)):
    return {"message": "Access granted"}

5. SSG Session Handling

// Check session on client-side after page load
if (typeof window !== 'undefined') {
  const token = localStorage.getItem('auth_token');
  if (token) {
    // Validate token with backend
    fetch('/api/validate-session', {
      headers: { 'Authorization': `Bearer ${token}` }
    });
  }
}