Astro Sessions docs improvement

[Fakerko]

Hello!

After a few hours of debugging, when I was about to jump out of the window, I figured out why Astro Sessions don't work in production with Node Adapter.

Missing SSL certificate!

If anyone runs into a similar problem, it would be nice to have this mentioned in the documentation, that you need to have an SSL certificate generated in production, otherwise Astro Sessions don't work.

Also, I noticed one thing in the documentation when I was looking for what it could be.

https://docs.astro.build/en/guides/sessions/#api-endpoints
The "await" before context.session?.set() is redundant.
For .get() it is correct.

It's in multiple places where .set()

[sarah11918]

Hello! I wonder how common it is for sites to not have an SSL certificate? I do think this is considered pretty standard web practice now, but curious what others have to say about this!

[Fakerko]

I don't think I'm the only one who has a test environment on a generated domain for which no SSL certificate is generated. Only when the project is tested and functional do I deploy it on a real domain that already has an SSL certificate.

Not to mention that at least I got into this situation and reached out. Consider how many people have gotten into this situation and not solved their problem.

Mentioning it in the documentation costs no one anything, but it can help a lot of people.

[ArmandPhilippot]

But this wasn't what you've described. You've mentioned "in production":

I figured out why Astro Sessions don't work in production with Node Adapter.

I guess Sarah was confused because of that and I think you're the first one reporting that issue (even in support questions on Discord I don't remember seeing that). So, any suggestions are appreciated! Discussions are there to... discuss about the best way to document something or if this is an edge case that could confuse/be useless to people instead of helping them.

Mentioning it in the documentation costs no one anything

It wasn't the issue. We just try to understand the use case/where the issue comes from to be able to document it in the best way. Sometimes it could be an edge case and confuse most people instead of helping them, or dilute important information. Other times, this is not related to Astro but a common thing and we can't document everything. So we need to identify the real issue/use case before adding it to the docs.

So Sarah's question is pertinent to identify the real information that could be useful for users. Now we know it can be useful for staging environments (rather than "production" environments) and for people not able to generate an SSL cert for these environments because of limitations with the services they're using.

So sure, if this is a requirement, adding somewhere that a valid SSL cert is required for the Sessions API to work could be helpful for some people! But I'm confused because the Vite server doesn't use SSL by default... Does sessions work in dev mode (I'm not familiar with Sessions)? If they are working, maybe there is something else to document here: for example different behavior between dev and prod, or if this is an issue specific to the Node adapter...

Regarding your other suggestion, yes we should update that: set is not async.

[Fakerko]

Yes, I mentioned "in production". Because Astro's base state is either "development" or "production", according to NODE_ENV.

Above I only gave an example of when this could occur.

It doesn't matter if it's on the server or locally, just build the project locally, run it locally using the Node adapter (doesn't matter if "standalone" or "middleware") and it doesn't work either.

To answer the question, yes, it works in development. So something has to be done differently in build, compared to development.