---
updatedAt: 2026-10-13T19:01:23.000Z
agentTools:
projectIndex: https://docs.wristband.dev/llms.txt
---
# Add Session Middleware
Integrate the required session middleware to manage and track authenticated user sessions.
Track user authentication status seamlessly by adding Wristband's session middleware to your project. This middleware attaches a `request.state.session` object containing user information to incoming requests. Session data remains protected within an encrypted cookie, which is automatically decrypted on subsequent requests to seamlessly rebuild the session state.
## Configure Session Middleware
Activate session management by registering the Wristband SDK's `SessionMiddleware` inside your FastAPI application. You must supply an accompanying `secret_key` that is at least 32 characters long. A secure key can be generated instantly via .
### Disabling Secure Session Cookies in Local Development
For security, session cookies are flagged as `secure` by default and require HTTPS. Most modern browsers grant a local testing exception for `http://localhost`, but Safari maintains higher security baselines and will refuse to transmit secure cookies over HTTP, even on `localhost`.
If you need to turn off the secure flag for local development, configure `secure=False` in your `SessionMiddleware`. However, it is critical to restore `secure=True` in production to keep your user session data fully protected.
```python Session Middleware With Secure Cookies
# src/main.py
from fastapi import FastAPI
from wristband.fastapi_auth import SessionMiddleware
def create_app() -> FastAPI:
app = FastAPI()
# Enable Wristband's session middlware on all routes.
app.add_middleware(SessionMiddleware, secret_key="")
# Your other application setup...
```
```python Session Middleware With Secure Cookies Disabled
# src/main.py
from fastapi import FastAPI
from wristband.fastapi_auth import SessionMiddleware
def create_app() -> FastAPI:
app = FastAPI()
# Enable Wristband's session middlware on all routes.
app.add_middleware(SessionMiddleware, secret_key="", secure=False)
# Your other application setup...
```
{`
`}