I’m not using the “vanilla” Plug.Session configuration! Like for many other plugs in the default Phoenix configuration, you hate to use init/1 and call/2 explicitly to bypass the default macro expansion at compile time.

I also extracted a get_options/0 function to a separate module to be {m, f, a} compatible and am not using the module attribute because it is not required anymore!

lib/foo_web/endpoint.ex

defmodule FooWeb.Endpoint do
  use Phoenix.Endpoint, otp_app: :foo
  …

  socket("/live", Phoenix.LiveView.Socket, 
    websocket: [
      connect_info: [
        {:session, {FooWeb.Session, :get_options, []}}
      ]
    ])
  …

  plug(Plug.MethodOverride)
  plug(Plug.Head)
  plug(:session)
  plug(FooWeb.Router)

  …

  defp session(conn, _opts) do
    opts = Plug.Session.init(FooWeb.Session.get_options())

    Plug.Session.call(conn, opts)
  end
 …

end

lib/foo_web/session.ex

defmodule FooWeb.Session do
  def get_options do
    [
      store: :cookie,
      key: System.get_env("SESSION_KEY"),
      signing_salt: System.get_env("SIGNING_SALT")
    ]
  end
end

On Phoenix master we allow the session connect_info to be an MFA, so stay tuned.

Thanks again @gcauchon, your solution works like a charm, awesome!
I decided to load session options into the application environment.
Also an inline session module will do the trick.

# MyApp.Application
...

def start(_type, _args) do
  Application.put_env(:my_app, :session_options, [
    store: :cookie,
    key: "session",
    signing_salt: System.fetch_env!("SESSION_SIGNING_SALT")
  ])
  children = [
  ...
end

...

Configure session at runtime.

# MyApp.Endpoint
...

defmodule Session do
  def options do
    Application.get_env(:my_app, :session_options)
  end
end

defp session(conn, _opts) do
  Plug.Session.call(conn, Plug.Session.init(
    Session.options()
  ))
end

...

socket "/live", Phoenix.LiveView.Socket, websocket: [
  connect_info: [session: {Session, :options, []}]
]

...

plug Plug.MethodOverride
plug Plug.Head
plug(:session)
plug MyApp.Router

...