transport
Configures how the typed session scheme installs the Sessions plugin.
Defaults to SessionTransportType.CookieId backed by a SessionStorageMemory instance private to this scheme, so the client only holds a random session ID and cannot tamper with session data. In-memory storage is intended for local development and single-instance deployments; pass a shared SessionStorage to keep sessions across restarts and instances.
By-value transports (SessionTransportType.Cookie, SessionTransportType.Header) send the serialized session value to the client. Because this value is the authenticated identity, add a transformer that protects it from tampering, for example, SessionTransportTransformerEncrypt; without one, clients can forge the session value and authenticate as any principal.