Adam Warski

I think if you want to share some state between deserialised objects, you'll need some kind of global state, or deserialise a `Database => Module` function. If you'd go with...

Do you mean the `requiredSession` directive? It would be weird if it broke anything, as it basically reads data from the headers. Unless you have refreshable sessions and the session...

Hm, well in the `oneOff` case, the only thing that `requiredSession` does is reading a header value, otherwise the context is unchanged. In your tests, is the session properly decoded...

As far as I understand, they are doing this to hide an internal API which wasn't meant to be used outside of Play. Do you think this affects akka-http-session in...

Thanks for the links! An interesting read :). For encryption I think in our case `CBC` would be fine - would you like to create a PR maybe?

"I am noticing that the refresh-token is rotated when the access token is expired and the refresh token is not. " I'm not sure I understand :) Which tokens are...

If the session is expired, then to prolong the session, it has to be first re-created using the refresh token - which "consumes" it. Hence a new one is created....

Well, unfortunately when the session is expired and re-created, both tokens are currently re-created. The difference between `touchRequiredSession` and `requiredSession` is that if the session didn't time out, `touch` will...

Thanks for the report, it will take a bit unfortunately before we get some free time to try and debug the issue. One thing that does go faster, though, is...

Sure, documenting the discovery process is definitely a good idea :)