sessions
Configures the OIDC session for this OAuth flow, including cookie transport and CSRF protection.
Sessions are enabled by default when OidcProviderConfig.oauth is configured. Use this block to customize the secure defaults (httpOnly, secure in production, SameSite=lax), CSRF protection, storage, or refresh strategy.
When enabled, the OAuth callback stores the verified OidcToken.Id session and plugin-managed refresh/logout routes are installed. Use authenticateWith(auth0.session) after Oidc.identityProvider to protect routes with that session.