Release 3.1

Added

• A more flexible way to specify custom implementations:
  require "resty.session".new { storage = require "my.storage"

Release 3.0

Fixed

• Lock releasing is a lot more robust now

Added

• Add idletime setting (thanks @Tieske), see session.cookie.idletime
• Add support for Cookie prefixes __Host- and __Secure- on Cookie
  name (see: https://tools.ietf.org/html/draft-ietf-httpbis-rfc6265bis-05#section-4.1.3)

Changed

• The whole codebase was refactored and simplified, especially implementing
  new storage adapters is now a lot easier
• Redis and Memcached spinlockwait was changed from microseconds to milliseconds and default
  is set to 150 milliseconds,
• Redis and Memcache will only release locks that current session instance holds
• DSHM session_dshm_store was renamed to session_dshm_region
• BASE64 encoding now strips the padding

Release 2.2.6

Added

• Add support for SameSite=None (#83) (thanks @bodewig)
• Style changes (#77) (thanks @Tieske)

Release 2.25

Added

• Add SSL support for the Redis storage option (#75) (thanks @Tieske)
• DSHM storage adapter (a distributed SHM storage based on Hazelcast for Nginx) (thanks @grrolland)

Release 2.24

Fixed

• Avoid use unix socket and redis password with empty string
• Provide session id when closing, otherwise the lock is not deleted

Added

• Added a configuration for session cookie max size (session.cookie.maxsize)

Release 2.23

Added

• Added pluggable strategies with default and a new regenerate strategy
• Added pluggable hmacs
• Added session.close
• Added ttl to storages
• Added session.cookie.discard, a ttl how long to keep old sessions when
  renewing (used by regenerate strategy

Release 2.22

Fixed

• Only sets self.cookie.secure if not defined (was introduced in 2.20/2.21)

Release 2.21

[2.21] - 2018-03-16

Screwed

• Forgot to bump version number.

[2.20] - 2018-03-16

Fixed

• Fixes issue where check addr and check scheme could be faked. See also: #47. Thanks @nielsole

Release 2.19

Fixed

• Fixes small bug where aes could generate invalid salt on invalid input that further crashes Lua with error: bad argument #2 to 'salt' (number expected, got no value)

Release 2.18

Fixed

• Automatically creates exactly 64 bits salt as required by the latest lua-resty-string. See also: #40. Thanks @peturorri.