Add ability to set cookie max age - issue #91

.traefik.yml

@@ -109,6 +109,8 @@ testData:
   oidcEndSessionURL: https://accounts.google.com/logout # Provider's end session endpoint
   enablePKCE: false # Enables PKCE (Proof Key for Code Exchange) for additional security
   cookieDomain: "" # Explicit domain for session cookies (e.g., ".example.com" for multi-subdomain setups)
+  cookiePrefix: "" # Custom prefix for cookie names (e.g., "_oidc_myapp_" for session isolation between middleware instances)
+  sessionMaxAge: 86400 # Maximum session age in seconds (default: 86400 = 24 hours, 0 = use default)
   overrideScopes: false # When true, replaces default scopes instead of appending (default: false)
   refreshGracePeriodSeconds: 60 # Seconds before token expiry to attempt proactive refresh (default: 60)
 
@@ -636,28 +638,101 @@ configuration:
   cookieDomain:
     type: string
     description: |
-      Explicit domain for session cookies. This is important for multi-subdomain setups 
+      Explicit domain for session cookies. This is important for multi-subdomain setups
       and reverse proxy deployments to ensure consistent cookie handling.
-      
+
       When set, all session cookies will use this domain. When not set, the domain
       is auto-detected from the request headers (X-Forwarded-Host or Host).
-      
+
       Use a leading dot for subdomain-wide cookies (e.g., ".example.com" allows
       cookies to be shared between app.example.com, api.example.com, etc.).
-      
+
       Use a specific domain for host-only cookies (e.g., "app.example.com" restricts
       cookies to that exact domain).
-      
+
       This setting is crucial to prevent authentication issues like "CSRF token missing
       in session" errors that can occur when cookies are created with inconsistent domains.
-      
+
       Examples:
       - ".example.com" - Allows all subdomains to share cookies
       - "app.example.com" - Restricts cookies to this specific host
-      
+
       Default: "" (auto-detected from request headers)
     required: false
 
+  cookiePrefix:
+    type: string
+    description: |
+      Custom prefix for session cookie names. This is essential for running multiple
+      middleware instances with different authorization requirements on the same domain.
+
+      By default, all middleware instances use the same cookie names (_oidc_raczylo_m,
+      _oidc_raczylo_a, etc.), which means they share session state. When you have
+      multiple instances with different access restrictions (e.g., one for general users
+      and one for admins), this session sharing can lead to authorization bypass issues.
+
+      Setting a unique cookiePrefix for each middleware instance ensures complete
+      session isolation, preventing users authenticated via one middleware from
+      automatically gaining access to routes protected by a different middleware.
+
+      The prefix is prepended to all session cookie names:
+      - Main session cookie: {prefix}m
+      - Access token cookie: {prefix}a
+      - Refresh token cookie: {prefix}r
+      - ID token cookie: {prefix}id
+
+      Examples:
+      - "_oidc_userauth_" - For general user authentication middleware
+      - "_oidc_adminauth_" - For admin-only authentication middleware
+      - "_oidc_api_" - For API-specific authentication middleware
+
+      Security Note: Use different cookie prefixes AND different sessionEncryptionKey
+      values for each middleware instance to ensure complete isolation.
+
+      Default: "_oidc_raczylo_" (standard prefix for backward compatibility)
+
+      See: https://github.com/lukaszraczylo/traefikoidc/issues/87
+    required: false
+
+  sessionMaxAge:
+    type: integer
+    description: |
+      Maximum session age in seconds before requiring re-authentication.
+
+      This setting controls how long a user's authentication session remains valid
+      before they must authenticate again through the OIDC provider. The session
+      age is tracked from the initial authentication time (created_at).
+
+      When a session exceeds this age:
+      - The session is cleared and invalidated
+      - The user is redirected to re-authenticate
+      - All session cookies are removed
+
+      Use Cases:
+      - High-security applications: Use shorter durations (e.g., 3600 = 1 hour)
+      - Standard applications: Default 24 hours balances security and UX
+      - Long-lived sessions: Extend for applications accessed infrequently
+        (e.g., 604800 = 7 days, 2592000 = 30 days)
+
+      Security Considerations:
+      - Shorter sessions provide better security but require more frequent logins
+      - Longer sessions improve user experience but increase security risk
+      - Consider your application's security requirements and user access patterns
+      - This is independent of token refresh - tokens can be refreshed during the session
+
+      Common Values:
+      - 3600 (1 hour) - High security applications
+      - 28800 (8 hours) - Working day session
+      - 86400 (24 hours) - Default, balances security and convenience
+      - 604800 (7 days) - Weekly session for less frequently accessed apps
+      - 2592000 (30 days) - Monthly session for infrequently used applications
+
+      Default: 86400 (24 hours)
+      Minimum: 0 (uses default of 24 hours)
+
+      See: https://github.com/lukaszraczylo/traefikoidc/issues/91
+    required: false
+
   overrideScopes:
     type: boolean
     description: |

README.md

@@ -128,6 +128,8 @@ The middleware supports the following configuration options:
 | `enablePKCE` | Enables PKCE (Proof Key for Code Exchange) for authorization code flow | `false` | `true`, `false` |
 | `refreshGracePeriodSeconds` | Seconds before token expiry to attempt proactive refresh | `60` | `120` |
 | `cookieDomain` | Explicit domain for session cookies (important for multi-subdomain setups) | auto-detected | `.example.com`, `app.example.com` |
+| `cookiePrefix` | Custom prefix for session cookie names (for isolating multiple middleware instances) | `_oidc_raczylo_` | `_oidc_userauth_`, `_oidc_admin_` |
+| `sessionMaxAge` | Maximum session age in seconds before requiring re-authentication | `86400` (24 hours) | `3600` (1 hour), `604800` (7 days) |
 | `audience` | Custom audience for access token validation (for Auth0 custom APIs, etc.) | `clientID` | `https://my-api.example.com` |
 | `strictAudienceValidation` | Reject sessions with access token audience mismatch (prevents token confusion attacks) | `false` | `true` |
 | `allowOpaqueTokens` | Enable opaque (non-JWT) access token support via RFC 7662 introspection | `false` | `true` |
@@ -885,6 +887,87 @@ spec:
 
 **Important**: The `cookieDomain` parameter is crucial when running behind a reverse proxy or when your application serves multiple subdomains. Without it, cookies may be created with inconsistent domains, leading to authentication issues like "CSRF token missing in session" errors.
 
+### With Multiple Middleware Instances (Session Isolation)
+
+When running multiple middleware instances with different authorization requirements (e.g., one for general users and one for admins), you must use different `cookiePrefix` values to prevent session sharing between instances:
+
+```yaml
+# Middleware for general user authentication
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: oidc-userauth
+  namespace: traefik
+spec:
+  plugin:
+    traefikoidc:
+      providerURL: https://auth.example.com
+      clientID: your-client-id
+      clientSecret: your-client-secret
+      sessionEncryptionKey: user-key-at-least-32-bytes-long
+      callbackURL: /oauth2/callback
+      cookiePrefix: "_oidc_userauth_"  # Unique prefix for this instance
+---
+# Middleware for admin authentication with stricter requirements
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: oidc-adminauth
+  namespace: traefik
+spec:
+  plugin:
+    traefikoidc:
+      providerURL: https://auth.example.com
+      clientID: your-client-id
+      clientSecret: your-client-secret
+      sessionEncryptionKey: admin-key-at-least-32-bytes-long  # Different encryption key
+      callbackURL: /oauth2/admin/callback  # Different callback URL
+      cookiePrefix: "_oidc_adminauth_"  # Different prefix for isolation
+      allowedUsers:  # Restricted to specific admin users
+        - [email protected]
+        - [email protected]
+```
+
+**Security Note**: When running multiple instances, ensure you use:
+1. **Different `cookiePrefix`** values to prevent cookie name collisions
+2. **Different `sessionEncryptionKey`** values for complete session isolation
+3. **Different `callbackURL`** paths to avoid routing conflicts
+
+This configuration prevents authorization bypass issues where a user authenticated via the general middleware could access admin-protected routes. See [issue #87](https://github.com/lukaszraczylo/traefikoidc/issues/87) for more details.
+
+### With Extended Session Duration
+
+For applications that users access infrequently (weekly or monthly), you can extend the session duration beyond the default 24 hours to reduce authentication friction:
+
+```yaml
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: oidc-long-session
+  namespace: traefik
+spec:
+  plugin:
+    traefikoidc:
+      providerURL: https://auth.example.com
+      clientID: your-client-id
+      clientSecret: your-client-secret
+      sessionEncryptionKey: your-key-at-least-32-bytes-long
+      callbackURL: /oauth2/callback
+      sessionMaxAge: 604800  # 7 days (in seconds)
+      # Other common values:
+      # 259200   - 3 days
+      # 604800   - 7 days
+      # 1209600  - 14 days
+      # 2592000  - 30 days
+```
+
+**Security Note**: Longer session durations improve user experience but increase security risk. Consider your application's security requirements:
+- **High-security apps**: Use shorter sessions (3600 = 1 hour)
+- **Standard apps**: Default 24 hours balances security and UX
+- **Low-frequency access apps**: Extend to 7-30 days for better UX
+
+See [issue #91](https://github.com/lukaszraczylo/traefikoidc/issues/91) for more details.
+
 ### With Custom Logging and Rate Limiting
 
 ```yaml

audience_validation_test.go

@@ -838,7 +838,7 @@ func TestAudienceEndToEndScenario(t *testing.T) {
 	}
 
 	logger := NewLogger("debug")
-	sm, err := NewSessionManager(strings.Repeat("a", MinSessionEncryptionKeyLength), false, "", logger)
+	sm, err := NewSessionManager(strings.Repeat("a", MinSessionEncryptionKeyLength), false, "", "", 0, logger)
 	if err != nil {
 		t.Fatalf("Failed to create session manager: %v", err)
 	}

azure_oidc_test.go

@@ -79,7 +79,7 @@ func TestAzureOIDCRegression(t *testing.T) {
 	tOidc := &mockTraefikOidc{TraefikOidc: baseOidc}
 
 	// Initialize session manager
-	sessionManager, _ := NewSessionManager("test-encryption-key-32-bytes-long", false, "", mockLogger)
+	sessionManager, _ := NewSessionManager("test-encryption-key-32-bytes-long", false, "", "", 0, mockLogger)
 	tOidc.sessionManager = sessionManager
 
 	// Mock the JWT verification to avoid JWKS lookup issues

config/unified_config.go

@@ -69,11 +69,12 @@ type SessionConfig struct {
 	MaxChunks     int    `json:"maxChunks" yaml:"maxChunks"`
 
 	// Cookie settings
-	Domain   string `json:"domain" yaml:"domain"`
-	Path     string `json:"path" yaml:"path"`
-	Secure   bool   `json:"secure" yaml:"secure"`
-	HttpOnly bool   `json:"httpOnly" yaml:"httpOnly"`
-	SameSite string `json:"sameSite" yaml:"sameSite"`
+	Domain       string `json:"domain" yaml:"domain"`
+	Path         string `json:"path" yaml:"path"`
+	Secure       bool   `json:"secure" yaml:"secure"`
+	HttpOnly     bool   `json:"httpOnly" yaml:"httpOnly"`
+	SameSite     string `json:"sameSite" yaml:"sameSite"`
+	CookiePrefix string `json:"cookiePrefix" yaml:"cookiePrefix"` // Prefix for cookie names (e.g., "_oidc_myapp_")
 
 	// Storage settings
 	StorageType     string        `json:"storageType" yaml:"storageType"` // "memory", "redis", "cookie"

csrf_session_test.go

@@ -18,7 +18,7 @@ func TestCSRFTokenSessionManagement(t *testing.T) {
 	// Test that CSRF tokens persist through the authentication flow
 	t.Run("CSRF_Token_Persists_After_Selective_Clear", func(t *testing.T) {
 		// Create a session manager
-		sessionManager, err := NewSessionManager("test-encryption-key-32-characters", false, "", NewLogger("debug"))
+		sessionManager, err := NewSessionManager("test-encryption-key-32-characters", false, "", "", 0, NewLogger("debug"))
 		require.NoError(t, err)
 
 		// Create initial request
@@ -90,7 +90,7 @@ func TestCSRFTokenSessionManagement(t *testing.T) {
 
 	// Test that marking session as dirty forces save
 	t.Run("Mark_Dirty_Forces_Session_Save", func(t *testing.T) {
-		sessionManager, err := NewSessionManager("test-encryption-key-32-characters", false, "", NewLogger("debug"))
+		sessionManager, err := NewSessionManager("test-encryption-key-32-characters", false, "", "", 0, NewLogger("debug"))
 		require.NoError(t, err)
 
 		req := httptest.NewRequest("GET", "http://example.com/test", nil)
@@ -126,7 +126,7 @@ func TestCSRFTokenSessionManagement(t *testing.T) {
 
 	// Test Azure-specific session handling
 	t.Run("Azure_Session_Cookie_Configuration", func(t *testing.T) {
-		sessionManager, err := NewSessionManager("test-encryption-key-32-characters", false, "", NewLogger("debug"))
+		sessionManager, err := NewSessionManager("test-encryption-key-32-characters", false, "", "", 0, NewLogger("debug"))
 		require.NoError(t, err)
 
 		// Simulate Azure callback scenario
@@ -158,7 +158,7 @@ func TestCSRFTokenSessionManagement(t *testing.T) {
 
 	// Test session continuity through auth flow
 	t.Run("Session_Continuity_Through_Auth_Flow", func(t *testing.T) {
-		sessionManager, err := NewSessionManager("test-encryption-key-32-characters", false, "", NewLogger("debug"))
+		sessionManager, err := NewSessionManager("test-encryption-key-32-characters", false, "", "", 0, NewLogger("debug"))
 		require.NoError(t, err)
 
 		// Step 1: Initial request
@@ -199,7 +199,7 @@ func TestCSRFTokenSessionManagement(t *testing.T) {
 
 	// Test large token handling doesn't affect CSRF
 	t.Run("Large_Tokens_Dont_Affect_CSRF", func(t *testing.T) {
-		sessionManager, err := NewSessionManager("test-encryption-key-32-characters", false, "", NewLogger("debug"))
+		sessionManager, err := NewSessionManager("test-encryption-key-32-characters", false, "", "", 0, NewLogger("debug"))
 		require.NoError(t, err)
 
 		req := httptest.NewRequest("GET", "http://example.com/test", nil)
@@ -262,7 +262,7 @@ func TestAuthFlowWithoutExternalDependencies(t *testing.T) {
 
 	// We can't fully initialize TraefikOidc without network access,
 	// but we can test the session management directly
-	sessionManager, err := NewSessionManager(plugin.SessionEncryptionKey, plugin.ForceHTTPS, "", NewLogger(plugin.LogLevel))
+	sessionManager, err := NewSessionManager(plugin.SessionEncryptionKey, plugin.ForceHTTPS, "", "", 0, NewLogger(plugin.LogLevel))
 	require.NoError(t, err)
 
 	t.Run("Session_Created_On_Protected_Request", func(t *testing.T) {
@@ -291,7 +291,7 @@ func TestAuthFlowWithoutExternalDependencies(t *testing.T) {
 // TestRegressionLoginLoop specifically tests the fix for issue #53
 func TestRegressionLoginLoop(t *testing.T) {
 	// This test verifies that the specific changes made to fix the login loop work correctly
-	sessionManager, err := NewSessionManager("test-encryption-key-32-characters", false, "", NewLogger("debug"))
+	sessionManager, err := NewSessionManager("test-encryption-key-32-characters", false, "", "", 0, NewLogger("debug"))
 	require.NoError(t, err)
 
 	// Simulate the exact flow that was causing the login loop
@@ -392,7 +392,7 @@ func TestRegressionLoginLoop(t *testing.T) {
 
 // TestCSRFValidationTiming tests timing-sensitive CSRF validation scenarios
 func TestCSRFValidationTiming(t *testing.T) {
-	sessionManager, err := NewSessionManager("test-encryption-key-32-characters", false, "", NewLogger("debug"))
+	sessionManager, err := NewSessionManager("test-encryption-key-32-characters", false, "", "", 0, NewLogger("debug"))
 	require.NoError(t, err)
 
 	t.Run("Rapid_Redirect_Maintains_CSRF", func(t *testing.T) {

main.go

@@ -226,7 +226,9 @@ func NewWithContext(ctx context.Context, config *Config, next http.Handler, name
 		t.logger.Debugf("No custom audience specified, using clientID as audience: %s", t.clientID)
 	}
 
-	t.sessionManager, _ = NewSessionManager(config.SessionEncryptionKey, config.ForceHTTPS, config.CookieDomain, t.logger) // Safe to ignore: session manager creation with fallback to defaults
+	// Convert sessionMaxAge from seconds to duration (0 will use default 24 hours)
+	sessionMaxAge := time.Duration(config.SessionMaxAge) * time.Second
+	t.sessionManager, _ = NewSessionManager(config.SessionEncryptionKey, config.ForceHTTPS, config.CookieDomain, config.CookiePrefix, sessionMaxAge, t.logger) // Safe to ignore: session manager creation with fallback to defaults
 	t.errorRecoveryManager = NewErrorRecoveryManager(t.logger)
 
 	// Initialize token resilience manager with default configuration

main_servehttp_test.go

@@ -539,7 +539,7 @@ func (m *MockSessionData) Clear(r *http.Request, w http.ResponseWriter) error {
 
 // Helper function to create a test session manager
 func createTestSessionManager(t *testing.T) *SessionManager {
-	sm, err := NewSessionManager("test-encryption-key-32-characters", false, "", NewLogger("debug"))
+	sm, err := NewSessionManager("test-encryption-key-32-characters", false, "", "", 0, NewLogger("debug"))
 	if err != nil {
 		t.Fatalf("Failed to create session manager: %v", err)
 	}

main_test.go

@@ -104,7 +104,7 @@ func (ts *TestSuite) Setup() {
 	}
 
 	logger := NewLogger("info")
-	ts.sessionManager, _ = NewSessionManager("test-secret-key-that-is-at-least-32-bytes", false, "", logger)
+	ts.sessionManager, _ = NewSessionManager("test-secret-key-that-is-at-least-32-bytes", false, "", "", 0, logger)
 
 	// Create WaitGroup for the OIDC instance
 	goroutineWG := &sync.WaitGroup{}
@@ -1274,7 +1274,7 @@ func TestHandleCallback(t *testing.T) {
 			ts.tOidc.tokenBlacklist = NewCache() // Use generic cache for blacklist
 
 			logger := NewLogger("info")
-			sessionManager, _ := NewSessionManager("test-secret-key-that-is-at-least-32-bytes", false, "", logger)
+			sessionManager, _ := NewSessionManager("test-secret-key-that-is-at-least-32-bytes", false, "", "", 0, logger)
 
 			// Create a new instance for each test to avoid state carryover
 			instanceExtractClaimsFunc := tc.extractClaimsFunc
@@ -1663,7 +1663,7 @@ func TestHandleLogout(t *testing.T) {
 	for _, tc := range tests {
 		t.Run(tc.name, func(t *testing.T) {
 			logger := NewLogger("info")
-			sessionManager, _ := NewSessionManager("test-secret-key-that-is-at-least-32-bytes", false, "", logger)
+			sessionManager, _ := NewSessionManager("test-secret-key-that-is-at-least-32-bytes", false, "", "", 0, logger)
 			tOidc := &TraefikOidc{
 				revocationURL:  mockRevocationServer.URL,
 				endSessionURL:  tc.endSessionURL,
@@ -1966,7 +1966,7 @@ func TestHandleExpiredToken(t *testing.T) {
 	for _, tc := range tests {
 		t.Run(tc.name, func(t *testing.T) {
 			logger := NewLogger("info")
-			sessionManager, _ := NewSessionManager("test-secret-key-that-is-at-least-32-bytes", false, "", logger)
+			sessionManager, _ := NewSessionManager("test-secret-key-that-is-at-least-32-bytes", false, "", "", 0, logger)
 
 			tOidc := &TraefikOidc{
 				sessionManager: sessionManager,

memory_leak_consolidated_test.go

@@ -253,6 +253,8 @@ func TestMemoryLeakConsolidated(t *testing.T) {
 					"test-encryption-key-32-bytes-long-enough",
 					false,
 					"",
+					"",
+					0,
 					tf.logger,
 				)
 				if err != nil {
@@ -293,6 +295,8 @@ func TestMemoryLeakConsolidated(t *testing.T) {
 					"test-encryption-key-32-bytes-long-enough",
 					false,
 					"",
+					"",
+					0,
 					tf.logger,
 				)
 				return err
@@ -695,6 +699,8 @@ func BenchmarkMemoryUsage(b *testing.B) {
 			"test-encryption-key-32-bytes-long-enough",
 			false,
 			"",
+			"",
+			0,
 			NewLogger("error"),
 		)
 		// No Cleanup method, defer not needed
@@ -774,6 +780,8 @@ func TestGoroutineLeaks(t *testing.T) {
 					"test-encryption-key-32-bytes-long-enough",
 					false,
 					"",
+					"",
+					0,
 					NewLogger("error"),
 				)
 				require.NoError(t, err)
@@ -863,6 +871,8 @@ func TestMemoryThresholds(t *testing.T) {
 			"test-encryption-key-32-bytes-long-enough",
 			false,
 			"",
+			"",
+			0,
 			NewLogger("error"),
 		)
 

profiling_test.go

@@ -65,7 +65,7 @@ func TestMemoryTestOrchestrator(t *testing.T) {
 	mto := NewMemoryTestOrchestrator(config, logger)
 
 	// Test registering a component
-	sessionManager, err := NewSessionManager("test-key-32-chars-long-for-testing", false, "", logger)
+	sessionManager, err := NewSessionManager("test-key-32-chars-long-for-testing", false, "", "", 0, logger)
 	if err != nil {
 		t.Fatalf("Failed to create session manager: %v", err)
 	}
@@ -111,7 +111,7 @@ func TestComponentProfilers(t *testing.T) {
 	logger := NewLogger("debug")
 
 	// Test Session Pool Profiler
-	sessionManager, err := NewSessionManager("test-key-32-chars-long-for-testing", false, "", logger)
+	sessionManager, err := NewSessionManager("test-key-32-chars-long-for-testing", false, "", "", 0, logger)
 	if err != nil {
 		t.Fatalf("Failed to create session manager: %v", err)
 	}

regression/regression_test.go

@@ -30,7 +30,7 @@ func testIssue53CSRFRegression(t *testing.T) {
 	// 3. Session cookies must be properly configured for HTTPS
 	// 4. CSRF token must persist through the OAuth flow
 
-	sessionManager, err := traefikoidc.NewSessionManager("test-encryption-key-32-characters", false, "", traefikoidc.NewLogger("debug"))
+	sessionManager, err := traefikoidc.NewSessionManager("test-encryption-key-32-characters", false, "", "", 0, traefikoidc.NewLogger("debug"))
 	require.NoError(t, err)
 
 	// Step 1: Initial request to protected resource
@@ -116,7 +116,7 @@ func testIssue53CSRFRegression(t *testing.T) {
 
 // testIssue53ReverseProxyHTTPS tests HTTPS detection in reverse proxy setups
 func testIssue53ReverseProxyHTTPS(t *testing.T) {
-	sessionManager, err := traefikoidc.NewSessionManager("test-encryption-key-32-characters", false, "", traefikoidc.NewLogger("debug"))
+	sessionManager, err := traefikoidc.NewSessionManager("test-encryption-key-32-characters", false, "", "", 0, traefikoidc.NewLogger("debug"))
 	require.NoError(t, err)
 
 	// Create authenticated session with Azure tokens
@@ -200,7 +200,7 @@ func testIssue53SameSiteCookies(t *testing.T) {
 
 	for _, tc := range testCases {
 		t.Run(tc.name, func(t *testing.T) {
-			sessionManager, err := traefikoidc.NewSessionManager("test-encryption-key-32-characters", false, "", traefikoidc.NewLogger("debug"))
+			sessionManager, err := traefikoidc.NewSessionManager("test-encryption-key-32-characters", false, "", "", 0, traefikoidc.NewLogger("debug"))
 			require.NoError(t, err)
 
 			req := httptest.NewRequest("GET", "http://internal/test", nil)

security_edge_cases_test.go

@@ -468,7 +468,7 @@ func TestSessionFixationAttack(t *testing.T) {
 	tc := newTestCleanup(t)
 
 	logger := NewLogger("debug")
-	sm, err := NewSessionManager("test-secret-key-that-is-at-least-32-bytes", false, "", logger)
+	sm, err := NewSessionManager("test-secret-key-that-is-at-least-32-bytes", false, "", "", 0, logger)
 	if err != nil {
 		t.Fatalf("Failed to create session manager: %v", err)
 	}
@@ -625,7 +625,7 @@ func TestSessionFixationAttack(t *testing.T) {
 // TestCSRFProtection tests CSRF protection in POST requests
 func TestCSRFProtection(t *testing.T) {
 	logger := NewLogger("debug")
-	sm, err := NewSessionManager("test-secret-key-that-is-at-least-32-bytes", false, "", logger)
+	sm, err := NewSessionManager("test-secret-key-that-is-at-least-32-bytes", false, "", "", 0, logger)
 	if err != nil {
 		t.Fatalf("Failed to create session manager: %v", err)
 	}

session.go

@@ -237,6 +237,8 @@ type SessionManager struct {
 	logger         *Logger
 	chunkManager   *ChunkManager
 	cookieDomain   string
+	cookiePrefix   string        // Prefix for cookie names (default: "_oidc_raczylo_")
+	sessionMaxAge  time.Duration // Maximum session age (default: 24 hours)
 	cleanupMutex   sync.RWMutex
 	forceHTTPS     bool
 	cleanupDone    bool
@@ -256,26 +258,40 @@ type SessionManager struct {
 //   - encryptionKey: The key for encrypting session cookies (minimum 32 bytes).
 //   - forceHTTPS: Whether to force HTTPS-only cookies regardless of request scheme.
 //   - cookieDomain: The domain for session cookies (empty for auto-detection).
+//   - cookiePrefix: Prefix for session cookie names (empty for default "_oidc_raczylo_").
+//   - sessionMaxAge: Maximum session age duration (0 for default 24 hours).
 //   - logger: Logger instance for debug and error logging.
 //
 // Returns:
 //   - The configured SessionManager instance.
 //   - An error if the encryption key does not meet minimum length requirements.
-func NewSessionManager(encryptionKey string, forceHTTPS bool, cookieDomain string, logger *Logger) (*SessionManager, error) {
+func NewSessionManager(encryptionKey string, forceHTTPS bool, cookieDomain string, cookiePrefix string, sessionMaxAge time.Duration, logger *Logger) (*SessionManager, error) {
 	if len(encryptionKey) < minEncryptionKeyLength {
 		return nil, fmt.Errorf("encryption key must be at least %d bytes long", minEncryptionKeyLength)
 	}
 
+	// Set default cookie prefix if not provided
+	if cookiePrefix == "" {
+		cookiePrefix = "_oidc_raczylo_"
+	}
+
+	// Set default session max age if not provided (24 hours for backward compatibility)
+	if sessionMaxAge == 0 {
+		sessionMaxAge = absoluteSessionTimeout
+	}
+
 	ctx, cancel := context.WithCancel(context.Background())
 
 	sm := &SessionManager{
-		store:        sessions.NewCookieStore([]byte(encryptionKey)),
-		forceHTTPS:   forceHTTPS,
-		cookieDomain: cookieDomain,
-		logger:       logger,
-		chunkManager: NewChunkManager(logger),
-		ctx:          ctx,
-		cancel:       cancel,
+		store:         sessions.NewCookieStore([]byte(encryptionKey)),
+		forceHTTPS:    forceHTTPS,
+		cookieDomain:  cookieDomain,
+		cookiePrefix:  cookiePrefix,
+		sessionMaxAge: sessionMaxAge,
+		logger:        logger,
+		chunkManager:  NewChunkManager(logger),
+		ctx:           ctx,
+		cancel:        cancel,
 	}
 
 	// Initialize global memory monitoring (singleton)
@@ -607,7 +623,7 @@ func (sm *SessionManager) GetSessionMetrics() map[string]interface{} {
 	metrics := make(map[string]interface{})
 	metrics["session_manager_type"] = "CookieStore"
 	metrics["force_https"] = sm.forceHTTPS
-	metrics["absolute_timeout_hours"] = absoluteSessionTimeout.Hours()
+	metrics["absolute_timeout_hours"] = sm.sessionMaxAge.Hours()
 	metrics["max_cookie_size"] = maxCookieSize
 	metrics["max_browser_cookie_size"] = maxBrowserCookieSize
 
@@ -641,7 +657,7 @@ func (sm *SessionManager) EnhanceSessionSecurity(options *sessions.Options, r *h
 		userAgent := r.Header.Get("User-Agent")
 		if userAgent == "" {
 			sm.logger.Debugf("Request from %s missing User-Agent header", r.RemoteAddr)
-			options.MaxAge = int((absoluteSessionTimeout / 2).Seconds())
+			options.MaxAge = int((sm.sessionMaxAge / 2).Seconds())
 		}
 
 		if r.Header.Get("X-Forwarded-Proto") == "https" || r.TLS != nil || sm.forceHTTPS {
@@ -691,7 +707,7 @@ func (sm *SessionManager) getSessionOptions(isSecure bool) *sessions.Options {
 		HttpOnly: true,
 		Secure:   isSecure || sm.forceHTTPS,
 		SameSite: http.SameSiteLaxMode,
-		MaxAge:   int(absoluteSessionTimeout.Seconds()),
+		MaxAge:   int(sm.sessionMaxAge.Seconds()),
 		Path:     "/",
 		Domain:   sm.cookieDomain,
 	}
@@ -821,7 +837,7 @@ func (sm *SessionManager) GetSession(r *http.Request) (*SessionData, error) {
 	}
 
 	if createdAt, ok := sessionData.mainSession.Values["created_at"].(int64); ok {
-		if time.Since(time.Unix(createdAt, 0)) > absoluteSessionTimeout {
+		if time.Since(time.Unix(createdAt, 0)) > sm.sessionMaxAge {
 			_ = sessionData.Clear(r, nil) // Safe to ignore: session is being invalidated
 			return handleError(fmt.Errorf("session timeout"), "session expired")
 		}
@@ -1130,7 +1146,7 @@ func (sd *SessionData) getAuthenticatedUnsafe() bool {
 	if !ok {
 		return false
 	}
-	return time.Since(time.Unix(createdAt, 0)) <= absoluteSessionTimeout
+	return time.Since(time.Unix(createdAt, 0)) <= sd.manager.sessionMaxAge
 }
 
 // SetAuthenticated sets the authentication status and manages session security.

session/core/cookie_prefix_test.go

@@ -0,0 +1,130 @@
+package core
+
+import (
+	"testing"
+)
+
+// TestCookiePrefix tests that custom cookie prefixes work correctly
+func TestCookiePrefix(t *testing.T) {
+	tests := []struct {
+		name         string
+		cookiePrefix string
+		wantMain     string
+		wantAccess   string
+		wantRefresh  string
+		wantID       string
+	}{
+		{
+			name:         "Default prefix",
+			cookiePrefix: "",
+			wantMain:     "_oidc_raczylo_m",
+			wantAccess:   "_oidc_raczylo_a",
+			wantRefresh:  "_oidc_raczylo_r",
+			wantID:       "_oidc_raczylo_id",
+		},
+		{
+			name:         "Custom prefix",
+			cookiePrefix: "_oidc_myapp_",
+			wantMain:     "_oidc_myapp_m",
+			wantAccess:   "_oidc_myapp_a",
+			wantRefresh:  "_oidc_myapp_r",
+			wantID:       "_oidc_myapp_id",
+		},
+		{
+			name:         "Custom prefix without underscore suffix",
+			cookiePrefix: "myapp",
+			wantMain:     "myappm",
+			wantAccess:   "myappa",
+			wantRefresh:  "myappr",
+			wantID:       "myappid",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			logger := &MockLogger{}
+			chunkManager := &MockChunkManager{}
+
+			sm, err := NewSessionManager(
+				"0123456789abcdef0123456789abcdef0123456789abcdef",
+				false,
+				"",
+				tt.cookiePrefix,
+				0,
+				logger,
+				chunkManager,
+			)
+			if err != nil {
+				t.Fatalf("Failed to create session manager: %v", err)
+			}
+
+			// Test cookie names
+			if got := sm.MainCookieName(); got != tt.wantMain {
+				t.Errorf("MainCookieName() = %q, want %q", got, tt.wantMain)
+			}
+			if got := sm.AccessTokenCookie(); got != tt.wantAccess {
+				t.Errorf("AccessTokenCookie() = %q, want %q", got, tt.wantAccess)
+			}
+			if got := sm.RefreshTokenCookie(); got != tt.wantRefresh {
+				t.Errorf("RefreshTokenCookie() = %q, want %q", got, tt.wantRefresh)
+			}
+			if got := sm.IDTokenCookie(); got != tt.wantID {
+				t.Errorf("IDTokenCookie() = %q, want %q", got, tt.wantID)
+			}
+		})
+	}
+}
+
+// TestMultipleInstancesWithDifferentPrefixes tests that multiple session managers
+// with different prefixes can coexist (addresses issue #87)
+func TestMultipleInstancesWithDifferentPrefixes(t *testing.T) {
+	logger := &MockLogger{}
+	chunkManager1 := &MockChunkManager{}
+	chunkManager2 := &MockChunkManager{}
+
+	// Create two session managers with different prefixes
+	sm1, err := NewSessionManager(
+		"0123456789abcdef0123456789abcdef0123456789abcdef",
+		false,
+		"example.com",
+		"_oidc_app1_",
+		0,
+		logger,
+		chunkManager1,
+	)
+	if err != nil {
+		t.Fatalf("Failed to create session manager 1: %v", err)
+	}
+
+	sm2, err := NewSessionManager(
+		"fedcba9876543210fedcba9876543210fedcba9876543210", // Different encryption key
+		false,
+		"example.com",
+		"_oidc_app2_",
+		0,
+		logger,
+		chunkManager2,
+	)
+	if err != nil {
+		t.Fatalf("Failed to create session manager 2: %v", err)
+	}
+
+	// Verify they have different cookie names
+	if sm1.MainCookieName() == sm2.MainCookieName() {
+		t.Error("Expected different main cookie names for different instances")
+	}
+
+	// Verify cookie name patterns
+	expectedPrefix1 := "_oidc_app1_"
+	expectedPrefix2 := "_oidc_app2_"
+
+	if sm1.MainCookieName() != expectedPrefix1+"m" {
+		t.Errorf("Expected main cookie name %s, got %s", expectedPrefix1+"m", sm1.MainCookieName())
+	}
+
+	if sm2.MainCookieName() != expectedPrefix2+"m" {
+		t.Errorf("Expected main cookie name %s, got %s", expectedPrefix2+"m", sm2.MainCookieName())
+	}
+
+	t.Log("✓ Session isolation verified: Different cookie prefixes prevent session sharing")
+}

session/core/session_manager.go

@@ -18,14 +18,16 @@ const (
 
 // SessionManager handles session creation, management and cleanup
 type SessionManager struct {
-	sessionPool  sync.Pool
-	store        sessions.Store
-	logger       Logger
-	chunkManager ChunkManager
-	cookieDomain string
-	cleanupMutex sync.RWMutex
-	forceHTTPS   bool
-	cleanupDone  bool
+	sessionPool   sync.Pool
+	store         sessions.Store
+	logger        Logger
+	chunkManager  ChunkManager
+	cookieDomain  string
+	cookiePrefix  string        // Prefix for cookie names (default: "_oidc_raczylo_")
+	sessionMaxAge time.Duration // Maximum session age (default: 24 hours)
+	cleanupMutex  sync.RWMutex
+	forceHTTPS    bool
+	cleanupDone   bool
 }
 
 // Logger interface for dependency injection
@@ -69,17 +71,29 @@ type SessionData interface {
 // NewSessionManager creates a new SessionManager instance with secure defaults.
 // It initializes the cookie store with encryption, sets up session pooling,
 // and configures chunk management for large tokens.
-func NewSessionManager(encryptionKey string, forceHTTPS bool, cookieDomain string, logger Logger, chunkManager ChunkManager) (*SessionManager, error) {
+func NewSessionManager(encryptionKey string, forceHTTPS bool, cookieDomain string, cookiePrefix string, sessionMaxAge time.Duration, logger Logger, chunkManager ChunkManager) (*SessionManager, error) {
 	if len(encryptionKey) < minEncryptionKeyLength {
 		return nil, fmt.Errorf("encryption key must be at least %d bytes long", minEncryptionKeyLength)
 	}
 
+	// Set default cookie prefix if not provided
+	if cookiePrefix == "" {
+		cookiePrefix = "_oidc_raczylo_"
+	}
+
+	// Set default session max age if not provided (24 hours for backward compatibility)
+	if sessionMaxAge == 0 {
+		sessionMaxAge = absoluteSessionTimeout
+	}
+
 	sm := &SessionManager{
-		store:        sessions.NewCookieStore([]byte(encryptionKey)),
-		forceHTTPS:   forceHTTPS,
-		cookieDomain: cookieDomain,
-		logger:       logger,
-		chunkManager: chunkManager,
+		store:         sessions.NewCookieStore([]byte(encryptionKey)),
+		forceHTTPS:    forceHTTPS,
+		cookieDomain:  cookieDomain,
+		cookiePrefix:  cookiePrefix,
+		sessionMaxAge: sessionMaxAge,
+		logger:        logger,
+		chunkManager:  chunkManager,
 	}
 
 	sm.sessionPool.New = func() interface{} {
@@ -114,7 +128,7 @@ func (sm *SessionManager) initializeSession(sessionData SessionData, r *http.Req
 	sessionData.SetManager(sm)
 
 	// Load session data from cookies
-	session, err := sm.store.Get(r, MainCookieName())
+	session, err := sm.store.Get(r, sm.MainCookieName())
 	if err != nil {
 		sm.logger.Debugf("Error getting main session: %v", err)
 		return nil // Not a fatal error, will create new session
@@ -315,14 +329,21 @@ func (sm *SessionManager) getSessionOptions(isSecure bool) *sessions.Options {
 	return &sessions.Options{
 		Path:     "/",
 		Domain:   sm.cookieDomain,
-		MaxAge:   int(absoluteSessionTimeout.Seconds()),
+		MaxAge:   int(sm.sessionMaxAge.Seconds()),
 		Secure:   isSecure,
 		HttpOnly: true,
 		SameSite: http.SameSiteLaxMode,
 	}
 }
 
-// Cookie name functions
+// Cookie name methods - these now use the configurable prefix
+func (sm *SessionManager) MainCookieName() string     { return sm.cookiePrefix + "m" }
+func (sm *SessionManager) AccessTokenCookie() string  { return sm.cookiePrefix + "a" }
+func (sm *SessionManager) RefreshTokenCookie() string { return sm.cookiePrefix + "r" }
+func (sm *SessionManager) IDTokenCookie() string      { return sm.cookiePrefix + "id" }
+
+// Package-level functions for backward compatibility (use default prefix)
+// These are deprecated and will be removed in a future version
 func MainCookieName() string     { return "_oidc_raczylo_m" }
 func AccessTokenCookie() string  { return "_oidc_raczylo_a" }
 func RefreshTokenCookie() string { return "_oidc_raczylo_r" }

session/core/session_manager_test.go

@@ -165,7 +165,7 @@ func TestSessionManagerCreation(t *testing.T) {
 			logger := &MockLogger{}
 			chunkManager := &MockChunkManager{}
 
-			sm, err := NewSessionManager(tt.encryptionKey, false, "", logger, chunkManager)
+			sm, err := NewSessionManager(tt.encryptionKey, false, "", "", 0, logger, chunkManager)
 
 			if tt.expectError {
 				if err == nil {
@@ -200,7 +200,7 @@ func TestSessionManagerCreation(t *testing.T) {
 func TestSessionManagerPoolBehavior(t *testing.T) {
 	logger := &MockLogger{}
 	chunkManager := &MockChunkManager{}
-	sm, err := NewSessionManager("0123456789abcdef0123456789abcdef0123456789abcdef", false, "", logger, chunkManager)
+	sm, err := NewSessionManager("0123456789abcdef0123456789abcdef0123456789abcdef", false, "", "", 0, logger, chunkManager)
 	if err != nil {
 		t.Fatalf("Failed to create session manager: %v", err)
 	}
@@ -291,7 +291,7 @@ func TestSessionManagerPoolBehavior(t *testing.T) {
 func TestSessionManagerErrorHandling(t *testing.T) {
 	logger := &MockLogger{}
 	chunkManager := &MockChunkManager{}
-	sm, err := NewSessionManager("0123456789abcdef0123456789abcdef0123456789abcdef", false, "", logger, chunkManager)
+	sm, err := NewSessionManager("0123456789abcdef0123456789abcdef0123456789abcdef", false, "", "", 0, logger, chunkManager)
 	if err != nil {
 		t.Fatalf("Failed to create session manager: %v", err)
 	}
@@ -390,7 +390,7 @@ func TestSessionManagerCleanup(t *testing.T) {
 	logger := &MockLogger{}
 	mockChunkManager := &MockChunkManager{}
 
-	sm, err := NewSessionManager("0123456789abcdef0123456789abcdef0123456789abcdef", false, "", logger, mockChunkManager)
+	sm, err := NewSessionManager("0123456789abcdef0123456789abcdef0123456789abcdef", false, "", "", 0, logger, mockChunkManager)
 	if err != nil {
 		t.Fatalf("Failed to create session manager: %v", err)
 	}
@@ -458,7 +458,7 @@ func TestSessionManagerHTTPSBehavior(t *testing.T) {
 			chunkManager := &MockChunkManager{}
 
 			sm, err := NewSessionManager("0123456789abcdef0123456789abcdef0123456789abcdef",
-				tt.forceHTTPS, "", logger, chunkManager)
+				tt.forceHTTPS, "", "", 0, logger, chunkManager)
 
 			if tt.expectError {
 				if err == nil {
@@ -520,7 +520,7 @@ func TestSessionManagerCookieDomain(t *testing.T) {
 			chunkManager := &MockChunkManager{}
 
 			sm, err := NewSessionManager("0123456789abcdef0123456789abcdef0123456789abcdef",
-				false, tt.cookieDomain, logger, chunkManager)
+				false, tt.cookieDomain, "", 0, logger, chunkManager)
 
 			if err != nil {
 				t.Errorf("Unexpected error for %s: %v", tt.description, err)
@@ -549,7 +549,7 @@ func BenchmarkSessionManagerCreation(b *testing.B) {
 	b.ResetTimer()
 
 	for i := 0; i < b.N; i++ {
-		sm, err := NewSessionManager(encryptionKey, false, "", logger, chunkManager)
+		sm, err := NewSessionManager(encryptionKey, false, "", "", 0, logger, chunkManager)
 		if err != nil {
 			b.Fatalf("Failed to create session manager: %v", err)
 		}
@@ -561,7 +561,7 @@ func BenchmarkSessionManagerCreation(b *testing.B) {
 func BenchmarkSessionManagerGetSession(b *testing.B) {
 	logger := &MockLogger{}
 	chunkManager := &MockChunkManager{}
-	sm, err := NewSessionManager("0123456789abcdef0123456789abcdef0123456789abcdef", false, "", logger, chunkManager)
+	sm, err := NewSessionManager("0123456789abcdef0123456789abcdef0123456789abcdef", false, "", "", 0, logger, chunkManager)
 	if err != nil {
 		b.Fatalf("Failed to create session manager: %v", err)
 	}
@@ -599,7 +599,7 @@ func minInt(a, b int) int {
 func TestValidateSessionHealth(t *testing.T) {
 	logger := &MockLogger{}
 	chunkManager := &MockChunkManager{}
-	sm, err := NewSessionManager("0123456789abcdef0123456789abcdef0123456789abcdef", false, "", logger, chunkManager)
+	sm, err := NewSessionManager("0123456789abcdef0123456789abcdef0123456789abcdef", false, "", "", 0, logger, chunkManager)
 	if err != nil {
 		t.Fatalf("Failed to create session manager: %v", err)
 	}
@@ -660,7 +660,7 @@ func TestValidateSessionHealth(t *testing.T) {
 func TestValidateTokenFormat(t *testing.T) {
 	logger := &MockLogger{}
 	chunkManager := &MockChunkManager{}
-	sm, err := NewSessionManager("0123456789abcdef0123456789abcdef0123456789abcdef", false, "", logger, chunkManager)
+	sm, err := NewSessionManager("0123456789abcdef0123456789abcdef0123456789abcdef", false, "", "", 0, logger, chunkManager)
 	if err != nil {
 		t.Fatalf("Failed to create session manager: %v", err)
 	}
@@ -727,7 +727,7 @@ func TestValidateTokenFormat(t *testing.T) {
 func TestDetectSessionTampering(t *testing.T) {
 	logger := &MockLogger{}
 	chunkManager := &MockChunkManager{}
-	sm, err := NewSessionManager("0123456789abcdef0123456789abcdef0123456789abcdef", false, "", logger, chunkManager)
+	sm, err := NewSessionManager("0123456789abcdef0123456789abcdef0123456789abcdef", false, "", "", 0, logger, chunkManager)
 	if err != nil {
 		t.Fatalf("Failed to create session manager: %v", err)
 	}
@@ -812,7 +812,7 @@ func TestGetSessionMetrics(t *testing.T) {
 			logger := &MockLogger{}
 			chunkManager := &MockChunkManager{}
 			sm, err := NewSessionManager("0123456789abcdef0123456789abcdef0123456789abcdef",
-				tt.forceHTTPS, tt.cookieDomain, logger, chunkManager)
+				tt.forceHTTPS, tt.cookieDomain, "", 0, logger, chunkManager)
 			if err != nil {
 				t.Fatalf("Failed to create session manager: %v", err)
 			}
@@ -898,7 +898,7 @@ func TestShouldUseSecureCookies(t *testing.T) {
 			logger := &MockLogger{}
 			chunkManager := &MockChunkManager{}
 			sm, err := NewSessionManager("0123456789abcdef0123456789abcdef0123456789abcdef",
-				tt.forceHTTPS, "", logger, chunkManager)
+				tt.forceHTTPS, "", "", 0, logger, chunkManager)
 			if err != nil {
 				t.Fatalf("Failed to create session manager: %v", err)
 			}
@@ -940,7 +940,7 @@ func TestGetSessionOptions(t *testing.T) {
 			logger := &MockLogger{}
 			chunkManager := &MockChunkManager{}
 			sm, err := NewSessionManager("0123456789abcdef0123456789abcdef0123456789abcdef",
-				false, tt.cookieDomain, logger, chunkManager)
+				false, tt.cookieDomain, "", 0, logger, chunkManager)
 			if err != nil {
 				t.Fatalf("Failed to create session manager: %v", err)
 			}

session_helpers_test.go

@@ -11,7 +11,7 @@ import (
 // TestSetCodeVerifier_NoChange tests the branch where the code verifier value doesn't change
 func TestSetCodeVerifier_NoChange(t *testing.T) {
 	logger := NewLogger("debug")
-	sm, err := NewSessionManager("0123456789abcdef0123456789abcdef0123456789abcdef", false, "", logger)
+	sm, err := NewSessionManager("0123456789abcdef0123456789abcdef0123456789abcdef", false, "", "", 0, logger)
 	if err != nil {
 		t.Fatalf("Failed to create session manager: %v", err)
 	}
@@ -52,7 +52,7 @@ func TestSetCodeVerifier_NoChange(t *testing.T) {
 // TestClearTokenChunks_EmptyChunks tests the branch where the chunks map is empty
 func TestClearTokenChunks_EmptyChunks(t *testing.T) {
 	logger := NewLogger("debug")
-	sm, err := NewSessionManager("0123456789abcdef0123456789abcdef0123456789abcdef", false, "", logger)
+	sm, err := NewSessionManager("0123456789abcdef0123456789abcdef0123456789abcdef", false, "", "", 0, logger)
 	if err != nil {
 		t.Fatalf("Failed to create session manager: %v", err)
 	}
@@ -90,7 +90,7 @@ func TestClearTokenChunks_EmptyChunks(t *testing.T) {
 // TestClearTokenChunks_WithSessions tests the branch where the chunks map contains actual sessions
 func TestClearTokenChunks_WithSessions(t *testing.T) {
 	logger := NewLogger("debug")
-	sm, err := NewSessionManager("0123456789abcdef0123456789abcdef0123456789abcdef", false, "", logger)
+	sm, err := NewSessionManager("0123456789abcdef0123456789abcdef0123456789abcdef", false, "", "", 0, logger)
 	if err != nil {
 		t.Fatalf("Failed to create session manager: %v", err)
 	}

session_test.go

@@ -84,7 +84,7 @@ func TestSessionPoolMemoryLeak(t *testing.T) {
 			}
 
 			logger := NewLogger("debug")
-			sm, err := NewSessionManager("0123456789abcdef0123456789abcdef0123456789abcdef", false, "", logger)
+			sm, err := NewSessionManager("0123456789abcdef0123456789abcdef0123456789abcdef", false, "", "", 0, logger)
 			if err != nil {
 				t.Fatalf("Failed to create session manager: %v", err)
 			}
@@ -107,7 +107,7 @@ func TestSessionPoolMemoryLeak(t *testing.T) {
 				session.ReturnToPool()
 
 			case "Error path in GetSession":
-				badSM, _ := NewSessionManager("different0123456789abcdef0123456789abcdef0123456789", false, "", logger)
+				badSM, _ := NewSessionManager("different0123456789abcdef0123456789abcdef0123456789", false, "", "", 0, logger)
 				_, err = badSM.GetSession(req)
 				if err == nil {
 					t.Log("Note: Expected error when using mismatched encryption keys")
@@ -172,7 +172,7 @@ func TestSessionErrorHandling(t *testing.T) {
 	for _, test := range tests {
 		t.Run(test.Name, func(t *testing.T) {
 			logger := NewLogger("debug")
-			sm, err := NewSessionManager("0123456789abcdef0123456789abcdef0123456789abcdef", false, "", logger)
+			sm, err := NewSessionManager("0123456789abcdef0123456789abcdef0123456789abcdef", false, "", "", 0, logger)
 			if err != nil {
 				t.Fatalf("Failed to create session manager: %v", err)
 			}
@@ -226,7 +226,7 @@ func TestSessionClearAlwaysReturnsToPool(t *testing.T) {
 			Timeout:            30 * time.Second,
 			Operation: func() error {
 				logger := NewLogger("debug")
-				sm, err := NewSessionManager("0123456789abcdef0123456789abcdef0123456789abcdef", false, "", logger)
+				sm, err := NewSessionManager("0123456789abcdef0123456789abcdef0123456789abcdef", false, "", "", 0, logger)
 				if err != nil {
 					return fmt.Errorf("failed to create session manager: %w", err)
 				}
@@ -264,7 +264,7 @@ func TestSessionClearAlwaysReturnsToPool(t *testing.T) {
 	// Additional verification test
 	t.Run("Verify pool still works after errors", func(t *testing.T) {
 		logger := NewLogger("debug")
-		sm, err := NewSessionManager("0123456789abcdef0123456789abcdef0123456789abcdef", false, "", logger)
+		sm, err := NewSessionManager("0123456789abcdef0123456789abcdef0123456789abcdef", false, "", "", 0, logger)
 		if err != nil {
 			t.Fatalf("Failed to create session manager: %v", err)
 		}
@@ -324,7 +324,7 @@ func TestSessionObjectTracking(t *testing.T) {
 			}
 
 			logger := NewLogger("debug")
-			sm, err := NewSessionManager("0123456789abcdef0123456789abcdef0123456789abcdef", false, "", logger)
+			sm, err := NewSessionManager("0123456789abcdef0123456789abcdef0123456789abcdef", false, "", "", 0, logger)
 			if err != nil {
 				t.Fatalf("Failed to create session manager: %v", err)
 			}
@@ -574,7 +574,7 @@ func TestTokenChunkingIntegrity(t *testing.T) {
 	for _, test := range tests {
 		t.Run(test.Name, func(t *testing.T) {
 			logger := NewLogger("debug")
-			sm, err := NewSessionManager("0123456789abcdef0123456789abcdef0123456789abcdef", false, "", logger)
+			sm, err := NewSessionManager("0123456789abcdef0123456789abcdef0123456789abcdef", false, "", "", 0, logger)
 			if err != nil {
 				t.Fatalf("Failed to create session manager: %v", err)
 			}
@@ -681,7 +681,7 @@ func TestTokenChunkingCorruptionResistance(t *testing.T) {
 	for _, test := range corruptionTests {
 		t.Run(test.Name, func(t *testing.T) {
 			logger := NewLogger("debug")
-			sm, err := NewSessionManager("0123456789abcdef0123456789abcdef0123456789abcdef", false, "", logger)
+			sm, err := NewSessionManager("0123456789abcdef0123456789abcdef0123456789abcdef", false, "", "", 0, logger)
 			if err != nil {
 				t.Fatalf("Failed to create session manager: %v", err)
 			}
@@ -772,7 +772,7 @@ func TestTokenSizeLimits(t *testing.T) {
 	for _, test := range tests {
 		t.Run(test.Name, func(t *testing.T) {
 			logger := NewLogger("debug")
-			sm, err := NewSessionManager("0123456789abcdef0123456789abcdef0123456789abcdef", false, "", logger)
+			sm, err := NewSessionManager("0123456789abcdef0123456789abcdef0123456789abcdef", false, "", "", 0, logger)
 			if err != nil {
 				t.Fatalf("Failed to create session manager: %v", err)
 			}
@@ -837,7 +837,7 @@ func TestConcurrentTokenOperations(t *testing.T) {
 			Timeout:            60 * time.Second,
 			Operation: func() error {
 				logger := NewLogger("debug")
-				sm, err := NewSessionManager("0123456789abcdef0123456789abcdef0123456789abcdef", false, "", logger)
+				sm, err := NewSessionManager("0123456789abcdef0123456789abcdef0123456789abcdef", false, "", "", 0, logger)
 				if err != nil {
 					return fmt.Errorf("failed to create session manager: %w", err)
 				}
@@ -925,7 +925,7 @@ func TestSessionValidationAndCleanup(t *testing.T) {
 	for _, test := range tests {
 		t.Run(test.Name, func(t *testing.T) {
 			logger := NewLogger("debug")
-			sm, err := NewSessionManager("0123456789abcdef0123456789abcdef0123456789abcdef", false, "", logger)
+			sm, err := NewSessionManager("0123456789abcdef0123456789abcdef0123456789abcdef", false, "", "", 0, logger)
 			if err != nil {
 				t.Fatalf("Failed to create session manager: %v", err)
 			}
@@ -1010,7 +1010,7 @@ func TestLargeIDTokenChunking(t *testing.T) {
 	for _, test := range tests {
 		t.Run(test.Name, func(t *testing.T) {
 			logger := NewLogger("debug")
-			sm, err := NewSessionManager("0123456789abcdef0123456789abcdef0123456789abcdef", false, "", logger)
+			sm, err := NewSessionManager("0123456789abcdef0123456789abcdef0123456789abcdef", false, "", "", 0, logger)
 			if err != nil {
 				t.Fatalf("Failed to create session manager: %v", err)
 			}
@@ -1115,7 +1115,7 @@ func BenchmarkSessionOperations(b *testing.B) {
 	perfHelper := NewPerformanceTestHelper()
 
 	logger := NewLogger("error") // Reduce logging for benchmarks
-	sm, err := NewSessionManager("0123456789abcdef0123456789abcdef0123456789abcdef", false, "", logger)
+	sm, err := NewSessionManager("0123456789abcdef0123456789abcdef0123456789abcdef", false, "", "", 0, logger)
 	if err != nil {
 		b.Fatalf("Failed to create session manager: %v", err)
 	}
@@ -1256,7 +1256,7 @@ func TestSessionStatePreservationWithExpiredTokens(t *testing.T) {
 	t.Log("Testing session state preservation with expired tokens - this test demonstrates BROKEN BEHAVIOR")
 
 	logger := NewLogger("debug")
-	sm, err := NewSessionManager("test-session-key-32-bytes-long-12345", false, "", logger)
+	sm, err := NewSessionManager("test-session-key-32-bytes-long-12345", false, "", "", 0, logger)
 	if err != nil {
 		t.Fatalf("Failed to create session manager: %v", err)
 	}
@@ -1452,7 +1452,7 @@ func TestSessionExpiryVsTokenExpiry(t *testing.T) {
 	t.Log("Testing session expiry vs token expiry distinction - validating proper session and token lifetime management")
 
 	logger := NewLogger("debug")
-	sm, err := NewSessionManager("session-vs-token-test-key-32-bytes", false, "", logger)
+	sm, err := NewSessionManager("session-vs-token-test-key-32-bytes", false, "", "", 0, logger)
 	if err != nil {
 		t.Fatalf("Failed to create session manager: %v", err)
 	}
@@ -1591,7 +1591,7 @@ func TestSessionCleanupOnTokenExpiry(t *testing.T) {
 	t.Log("Testing session cleanup on token expiry - validating proper session data management")
 
 	logger := NewLogger("debug")
-	sm, err := NewSessionManager("cleanup-test-key-32-bytes-long-123", false, "", logger)
+	sm, err := NewSessionManager("cleanup-test-key-32-bytes-long-123", false, "", "", 0, logger)
 	if err != nil {
 		t.Fatalf("Failed to create session manager: %v", err)
 	}

settings.go

@@ -30,6 +30,8 @@ type Config struct {
 	HTTPClient        *http.Client `json:"-"`
 	OIDCEndSessionURL string       `json:"oidcEndSessionURL"`
 	CookieDomain      string       `json:"cookieDomain"`
+	CookiePrefix      string       `json:"cookiePrefix"`  // Prefix for session cookie names (default: "_oidc_raczylo_")
+	SessionMaxAge     int          `json:"sessionMaxAge"` // Maximum session age in seconds (default: 86400 = 24 hours)
 	CallbackURL       string       `json:"callbackURL"`
 	LogoutURL         string       `json:"logoutURL"`
 	ClientID          string       `json:"clientID"`

test_framework_test.go

@@ -279,6 +279,8 @@ func (tf *TestFramework) CreateAuthenticatedRequest(method, path string) (*http.
 		tf.fixtures.EncryptionKey,
 		false,
 		"",
+		"",
+		0,
 		tf.oidc.logger,
 	)
 	if err != nil {
@@ -323,6 +325,8 @@ func (tf *TestFramework) CreateCallbackRequest() *http.Request {
 		tf.fixtures.EncryptionKey,
 		false,
 		"",
+		"",
+		0,
 		tf.oidc.logger,
 	)
 

test_helpers_adapter_test.go

@@ -204,7 +204,7 @@ func setupTestOIDCMiddleware(t *testing.T, config *Config) (*TraefikOidc, *httpt
 		logInfo:  log.New(&testWriter{t}, "INFO: ", 0),
 		logDebug: log.New(&testWriter{t}, "DEBUG: ", 0),
 	}
-	sessionManager, _ := NewSessionManager(config.SessionEncryptionKey, false, "", logger)
+	sessionManager, _ := NewSessionManager(config.SessionEncryptionKey, false, "", "", logger)
 
 	// Create next handler
 	nextHandler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
@@ -350,7 +350,7 @@ func createMockJWT(t *testing.T, sub, email string) string {
 func createTestSession() *SessionData {
 	// Create a minimal session manager for testing
 	logger := newNoOpLogger()
-	sessionManager, _ := NewSessionManager("test-encryption-key-32-characters", false, "", logger)
+	sessionManager, _ := NewSessionManager("test-encryption-key-32-characters", false, "", "", 0, logger)
 
 	// Create a test request
 	req := httptest.NewRequest("GET", "/", nil)

token_consolidated_test.go

@@ -164,7 +164,7 @@ func TestTokenTypes(t *testing.T) {
 func TestTokenCorruption(t *testing.T) {
 	t.Run("TokenCorruptionScenario", func(t *testing.T) {
 		logger := NewLogger("debug")
-		sm, err := NewSessionManager("0123456789abcdef0123456789abcdef0123456789abcdef", false, "", logger)
+		sm, err := NewSessionManager("0123456789abcdef0123456789abcdef0123456789abcdef", false, "", "", 0, logger)
 		if err != nil {
 			t.Fatalf("Failed to create session manager: %v", err)
 		}
@@ -291,7 +291,7 @@ func TestTokenCorruption(t *testing.T) {
 func TestTokenResilience(t *testing.T) {
 	t.Run("ConcurrentTokenAccess", func(t *testing.T) {
 		logger := NewLogger("debug")
-		sm, err := NewSessionManager("0123456789abcdef0123456789abcdef0123456789abcdef", false, "", logger)
+		sm, err := NewSessionManager("0123456789abcdef0123456789abcdef0123456789abcdef", false, "", "", 0, logger)
 		if err != nil {
 			t.Fatalf("Failed to create session manager: %v", err)
 		}
@@ -337,7 +337,7 @@ func TestTokenResilience(t *testing.T) {
 
 	t.Run("TokenSizeHandling", func(t *testing.T) {
 		logger := NewLogger("debug")
-		sm, err := NewSessionManager("0123456789abcdef0123456789abcdef0123456789abcdef", false, "", logger)
+		sm, err := NewSessionManager("0123456789abcdef0123456789abcdef0123456789abcdef", false, "", "", 0, logger)
 		if err != nil {
 			t.Fatalf("Failed to create session manager: %v", err)
 		}