[crimson-knight]

What changes in a new app

The session block in every generated config/environments/*.yml:

session:
  key: "my_app.session"
  # signed_cookie keeps the session in the visitor's cookie: tamper-proof, readable by
  # the visitor, about 4 KB, and nothing is held on the server. encrypted_cookie also
  # hides it from the visitor. adapter keeps sessions on the server through `adapter`.
  store: "signed_cookie"
  # Used only when store is adapter: memory (at most 10,000 sessions per process) or redis.
  adapter: "memory"
  # Seconds a session lasts after its last change (two weeks). 0 makes cookie sessions
  # end when the browser closes and lets server-side sessions live until evicted.
  expires: 1209600

• expires goes from 0 to two weeks. With 0, server-side sessions were never freed: the Amber benchmark lab measured the generated Pet Tracker growing from 12.7 MiB to 150 MiB in five minutes of cookie-free traffic on a 512 MB droplet until it was OOM-killed.
• The comments say what each store keeps where, so the choice is visible in the file people edit.

Updated in both places that produce these files: NewCommand#environment_config (the live path) and templates/app/config/environments/*.yml.ecr.

Depends on

crimson-knight/amber#18, which makes Amber honor session.store (so signed_cookie really keeps sessions in the cookie), adds store: adapter, and caps the memory adapter at 10,000 sessions. The commit message names it as amberframework/amber#18; the correct link is crimson-knight/amber#18. The generated value (signed_cookie) works on the current Amber release either way; store: adapter is accepted once a release contains #18.

Verification

crystal-alpha spec spec/commands/new_command_spec.cr: 168 examples, 0 failures. The #execute spec now asserts store: signed_cookie and expires: 1209600 in the generated development and test files (production.yml is encrypted at generation).