# Session v8\.2\.0: Improved session safety with overlapping requests and encrypted Redis/Database stores

Canonical URL : https://adonisjs-signal.jrmc.dev/insights/65d0337b-ba9b-4b88-86b1-c0e1ca9518cb
Source release or documentation date : 2026-10-17T18:43:26.000Z
Category : release | Developer impact : high
Breaking change: yes
Action required: yes
Affected packages : @adonisjs/session

The AdonisJS session package v8\.2\.0 introduces robustness against overlapping requests from the same browser, preventing ended sessions from being resurrected by late requests\. It adds opt\-in protections that change visible behavior, including options to control cookie refreshing and session ID renewal\. Redis and database stores now support encryption of session data\. Several bug fixes improve atomicity and correctness of session writes and tagging\.

## What this means for your code

Developers using @adonisjs/session can benefit from safer session handling in concurrent request scenarios\. By default, existing behavior remains unchanged, but new options like \`refreshCookie\`, \`renewMissingSessionId\`, and \`encrypt\` allow opting into enhanced security features\. Enabling encryption on Redis or database stores will invalidate existing sessions\. Test sessions now respect the configured store instead of always using memory\. Developers should review and optionally update their session configuration to leverage these improvements\.

## Suggested actions

- Review new session config options: \`refreshCookie\`, \`renewMissingSessionId\`, and \`encrypt\` for Redis/database stores\.
- If using Redis or database stores, consider enabling \`encrypt\` to secure session data, noting existing sessions will be invalidated\.
- Test session handling in scenarios with overlapping requests to ensure expected behavior\.
- Update tests if relying on session store behavior, as japa test sessions now use the configured store\.
- Adjust cookie\-related settings if using \`refreshCookie: false\` to pair with \`clearWithBrowser\` for proper cookie expiration\.

## Original sources

- [Safer sessions with overlapping requests and encrypted redis/database stores](https://github.com/adonisjs/session/releases/tag/v8.2.0)

AI-generated analysis based on the linked sources. Check the original documentation before changing your application.