RestingOwl owl logo RestingOwl
Session Management Library

Meet owlsessionguard

Create, rotate, and revoke sessions in Node.js the safe way, without owning your storage. Built to the OWASP Session Management guidance and ASVS 5.0.

Install via npm
$ npm install @restingowlorg/owlsessionguard
Star on GitHub
🔐

owlsessionguard

@restingowlorg/owlsessionguard
npm version MIT license

High-entropy session tokens, hash-only storage, automatic rotation with reuse detection, idle and absolute expiration, device and IP binding, HMAC CSRF tokens, concurrent session limits, and Redis or in-memory storage, all behind one typed API.

🔐
Secure Session Lifecycle

Create, validate, rotate, revoke, revoke-all and list user sessions through one typed service.

🗝️
Hash-Only Storage

The raw token is returned once and never persisted. Built-in stores keep only a hash.

🕵️
Rotation & Reuse Detection

Rotated tokens are one-time. Reuse of an old token can revoke the whole session tree.

📍
Device & IP Binding

Optional IP and device fingerprint checks with soft or hard enforcement modes.

🛡️
CSRF Protection

HMAC-signed CSRF tokens bound to the server-side session ID.

🧩
Express, Fastify & NestJS

Middleware attaches a typed session context to requests across three frameworks.

🛡️
Built OWASP-first

Session handling traced to the OWASP Session Management Cheat Sheet, ASVS 5.0 and OWASP Top 10:2025, with hash-only storage and rotation on by default. See the full docs →

Attack Coverage

What OwlSessionGuard Blocks

Every control is traced to a specific OWASP standard. No guesswork, no checkbox security.

🎫
Session Hijacking
High-entropy tokens, hash-only storage, and optional device and IP binding make a stolen session hard to use.
OWASP A07:2021
🔁
Session Token Reuse
Rotation makes each token one-time, and reuse of a rotated token can revoke the whole session tree.
OWASP A07:2021
♻️
Session Fixation
Tokens rotate on login and privilege change, so a token fixed before sign in cannot be reused after.
OWASP A07:2021
🚪
No Logout Everywhere
Revoke and revoke-all end a single session or every session for a user across devices at once.
OWASP A07:2021
🎭
Cross-Site Request Forgery
HMAC-signed CSRF tokens are bound to the session ID, so a token cannot be moved between sessions.
OWASP A01:2021
⏱️
Never-Expiring Sessions
Idle and absolute timeouts, plus concurrent session limits, end stale and excess sessions automatically.
OWASP A07:2021

OwlSessionGuard FAQ

No. The raw session token is returned to the caller once at creation and is never persisted by the built-in stores. Only a hash of the token is stored, so a leak of your session store does not expose usable tokens.
It ships an in-memory store for local and test use and a Redis store for production. It also ships middleware for Express, Fastify, and NestJS that attaches a typed session context to each request, and the core service is framework-agnostic.
Sessions rotate their token, and each rotated token is one-time use. If an old, already-rotated token is presented again, that is treated as a reuse signal and can revoke the affected session tree, which stops a stolen token from being replayed.
Yes. It issues HMAC-signed CSRF tokens that are bound to the server-side session ID, so a token from one session cannot be used with another. It also supports idle and absolute timeouts, concurrent session limits, and optional device and IP binding.
Copied!