René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"[Feature]: First-party session, auth, and middleware primitives for `server`","articleBody":"**Pre-flight checklist**\n- [x] I searched existing issues and did not find a duplicate request.\n- [x] I explained the problem or use case, not just the desired API.\n\n**Problem or use case**\nBeyond WebSocket sessions, `server` has no first-party session, authentication, or composable middleware story. Every non-trivial service needs request-scoped sessions, some auth primitive, and a middleware pipeline; without them, adopters must hand-roll these or pull dependencies — which both undermines the \"batteries-included, dependency-free backend\" claim and is a blocker to `server` Stable (#131).\n\n**Proposed solution**\nAdd a small, secure-by-default middleware pipeline plus session and auth primitives: signed/encrypted cookie sessions, a pluggable session store interface (in-memory default, bring-your-own for Redis/etc. without bundling a client), CSRF protection that composes with the security module, and minimal auth helpers (credential verification hooks, route guards mirroring the router's guard ergonomics). Keep each primitive independently importable and tree-shakeable.\n\n**Possible API or UX shape**\n```ts\nimport { createApp, session, csrf, guard } from \"@bquery/bquery/server\";\n\nconst app = createApp();\napp.use(session({ secret: env.SECRET, store: memoryStore() }));\napp.use(csrf());\n\napp.route(\"GET\", \"/me\", guard(ctx =\u003e !!ctx.session.userId), ctx =\u003e {\n  return ctx.renderResponse(MeView, { userId: ctx.session.userId });\n});\n```\n\n**Alternatives considered**\nDocumenting recipes for third-party session/auth libraries — contradicts the dependency-free goal and leaves security-critical code to users. A full identity provider — over-scoped; the right scope is primitives (sessions, CSRF, guards) that compose, not a turnkey auth system.\n\n**Relevant area**\n`server`\n\n**Additional context**\nShould reuse the existing security module (sanitize/Trusted Types/CSP) so the backend inherits secure-by-default behavior. Pairs naturally with form actions (#140) and file-based route actions (#149), which need server-side session context.\n","author":{"url":"https://github.com/JosunLP","@type":"Person","name":"JosunLP"},"datePublished":"2026-06-26T21:25:09.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":0},"url":"https://github.com/132/bQuery/issues/132"}