Documentation
¶
Overview ¶
Package session keeps string values in a signed client-side cookie.
Index ¶
Constants ¶
View Source
const DefaultName = "zinc_session"
DefaultName is the cookie name used when Config.Name is empty.
Variables ¶
View Source
var ( ErrInvalid = errors.New("session: invalid session") ErrCommitted = errors.New("session: response already committed") ErrTooLarge = errors.New("session: cookie exceeds 4096 bytes") )
ErrInvalid identifies a cookie that fails decoding or authentication.
Functions ¶
func New ¶
func New(configs ...Config) zinc.Middleware
New loads the signed session cookie into a Session for the request. Set and Delete persist headers immediately and must run before response output.
Types ¶
type Config ¶
type Config struct {
Name string
// Secret signs the cookie. It must hold at least 32 random bytes.
Secret []byte
// PreviousSecrets are verification-only keys for a bounded rotation window.
PreviousSecrets [][]byte
// Lifetime bounds browser-session cookies (MaxAge == 0); defaults to 24h.
Lifetime time.Duration
// Now supplies the clock; defaults to time.Now.
Now func() time.Time
Path string
Domain string
MaxAge int
Secure bool
DisableHTTPOnly bool
SameSite http.SameSite
}
Config controls the signed client-side session cookie. Secret is required; everything else defaults to an HTTP-only, SameSite=Lax cookie named DefaultName on path "/" that lasts 24 hours.
type Session ¶
type Session struct {
// contains filtered or unexported fields
}
Session stores string values for one request. Values are authenticated but not encrypted; do not place secrets in the client-visible cookie.
Source Files
Click to show internal directories.
Click to hide internal directories.