iron-session
MIT stateless encrypted cookie sessions for JavaScript
Next.js / App Platform · OSS/MIT · 4.1k
Reviewed 2026-10-18 · last push 2026-10-12 · repo checked 2026-10-19
What's Good
MIT (vvo/iron-session), release v9.0.1 (2026-08-30). Featured in the Next.js docs, it works with the App Router, route handlers, server actions, Express and other Node-style runtimes. It is the same technique Rails uses for cookie sessions. Online demo with examples. ★~4.1k.
The Catch
v9 requires Node 22.13+ and is ESM-only, so upgrading from v8 needs code changes. Cookies cap out at about 4 KB, so store IDs, not big objects. Stateless sessions cannot be revoked server-side without extra bookkeeping. It manages sessions; login, OAuth and passwords are up to you.
Verdict
The simplest secure session layer for a Next.js app.
Embed
Maintainer? Add the badge to your README. It is free, links to this review, and there is no paid version.
Markdown
[](https://stackgems.com/gems/iron-session)
HTML
<a href="https://stackgems.com/gems/iron-session"><img src="https://stackgems.com/badge/iron-session.svg" alt="iron-session reviewed on Stack Gems" height="20"></a>