@@ -16,6 +16,7 @@ data in one of the available session storage backends.
1616
1717At present the available backends are (as passed to `--session-store-type`):
1818- [cookie](cookie-storage) (default)
19+- [redis](redis-storage)
1920
2021### Cookie Storage
2122
@@ -32,3 +33,26 @@ The following should be known when using this implementation:
3233- Since multiple requests can be made concurrently to the OAuth2 Proxy, this session implementation
3334cannot lock sessions and while updating and refreshing sessions, there can be conflicts which force
3435users to re-authenticate
36+
37+
38+### Redis Storage
39+
40+The Redis Storage backend stores sessions, encrypted, in redis. Instead sending all the information
41+back the the client for storage, as in the [Cookie storage](cookie-storage), a ticket is sent back
42+to the user as the cookie value instead.
43+
44+A ticket is composed as the following:
45+
46+`{CookieName}-{ticketID}.{secret}`
47+
48+Where:
49+
50+- The `CookieName` is the OAuth2 cookie name (_oauth2_proxy by default)
51+- The `ticketID` is a 128 bit random number, hex-encoded
52+- The `secret` is a 128 bit random number, base64url encoded (no padding). The secret is unique for every session.
53+- The pair of `{CookieName}-{ticketID}` comprises a ticket handle, and thus, the redis key
54+to which the session is stored. The encoded session is encrypted with the secret and stored
55+in redis via the `SETEX` command.
56+
57+Encrypting every session uniquely protects the refresh/access/id tokens stored in the session from
58+disclosure.