Session Store

Why Redis for sessions?

Application servers are stateless — sessions must live somewhere external. Redis is a natural fit: it is fast, supports key expiry natively, and its hash type maps cleanly onto a session object with named fields.

Storing a session as a hash

Each session is stored at key session:<id>. Fields such as userId, email, and role map directly to hash fields. An EXPIRE sets the idle timeout; refreshing that expiry on every authenticated request gives a sliding TTL.

Redis CLI demo

127.0.0.1:6379> HSET session:abc123 userId 42 email "[email protected]" role "admin"
(integer) 3
127.0.0.1:6379> EXPIRE session:abc123 1800
(integer) 1
127.0.0.1:6379> HGETALL session:abc123
1) "userId"
2) "42"
3) "email"
4) "[email protected]"
5) "role"
6) "admin"
127.0.0.1:6379> HGET session:abc123 role
"admin"
127.0.0.1:6379> EXPIRE session:abc123 1800
(integer) 1
127.0.0.1:6379> TTL session:abc123
(integer) 1799

HSET with multiple field-value pairs creates the session in one round trip. HGETALL returns every field; HGET fetches a single field. Calling EXPIRE again resets the countdown, implementing the sliding idle timeout.

HSET session:abc123 userId 42 email "[email protected]" role "admin"
EXPIRE session:abc123 1800
HGETALL session:abc123
HGET session:abc123 role
EXPIRE session:abc123 1800
TTL session:abc123

Copy commands ⧉

Hashes vs. serialised JSON

Storing the session as a single JSON string is tempting but forces you to deserialise the entire blob just to read or change one field. With a hash, HGET fetches only the field you need and HSET updates only the field that changed — no round-trip of the full session value, and no risk of a write overwriting a concurrent update to a different field.

Updating a single field

127.0.0.1:6379> HSET session:abc123 role "superadmin"
(integer) 0
127.0.0.1:6379> HGET session:abc123 role
"superadmin"

HSET returns 0 when it updates an existing field (no new field was added). Only the role field is touched; every other field remains unchanged.

HSET session:abc123 role "superadmin"
HGET session:abc123 role

Copy commands ⧉

🟥 Store sessions as hashes with a sliding TTL

Call EXPIRE on every authenticated request to keep active sessions alive. When the user logs out, call DEL session:<id> explicitly. Hashes let you read or update individual fields without round-tripping the full session blob.

Which command reads all fields and values of a hash?

HGETALL HMGET HSCAN HKEYS

How do you implement a sliding idle timeout for a session?

Set a very long TTL once at login Call EXPIRE on every authenticated request to reset the countdown Use PERSIST to remove the TTL Use PEXPIRE with milliseconds only

Why store a session as a hash rather than a JSON string?

Hashes use less memory always Individual fields can be read or updated without deserialising the whole value Redis does not support strings longer than 512 bytes Hashes have built-in encryption

What command deletes a session on logout?

EXPIRE session:id 0 HDEL session:id DEL session:id UNSET session:id

Submit

Mark as complete