Documentation
¶
Index ¶
- Constants
- func KeyFromString(s string) []byte
- func Middleware(cfg Config) router.Middleware
- type Config
- type CookieStoreImpl
- type DatabaseStore
- func (s *DatabaseStore) Destroy(ctx context.Context, id string) error
- func (s *DatabaseStore) EnsureTable() error
- func (s *DatabaseStore) Get(ctx context.Context, id string) (map[string]any, error)
- func (s *DatabaseStore) Set(ctx context.Context, id string, data map[string]any, maxAge time.Duration) (string, error)
- type MemoryStore
- type RedisStore
- type Session
- type SessionRecord
- type Store
Constants ¶
const ( SameSiteLax = http.SameSiteLaxMode SameSiteStrict = http.SameSiteStrictMode SameSiteNone = http.SameSiteNoneMode )
SameSite values.
Variables ¶
This section is empty.
Functions ¶
func KeyFromString ¶
KeyFromString derives a 32-byte key from a string (e.g. APP_KEY) using HKDF-SHA256. Provide a high-entropy APP_KEY (32 random bytes); this is not a password-stretching KDF.
func Middleware ¶
func Middleware(cfg Config) router.Middleware
Middleware returns middleware that loads the session from the store and sets it on the request context. If no session cookie exists, a new session is created on first write.
Types ¶
type Config ¶
type Config struct {
Store Store
CookieName string
MaxAge time.Duration
HttpOnly bool
Secure bool
SameSite http.SameSite
}
Config holds session middleware options.
Cookie security attributes are secure-by-default: the session cookie is always written with HttpOnly, and with SameSite=Lax unless overridden. The Secure flag is set automatically whenever the request is served over HTTPS (TLS or X-Forwarded-Proto: https); set Secure=true to force it on even behind a proxy that does not forward the scheme.
type CookieStoreImpl ¶
type CookieStoreImpl struct {
// contains filtered or unexported fields
}
func NewCookieStore ¶
func NewCookieStore(key []byte) *CookieStoreImpl
NewCookieStore creates a cookie-based session store. Session data is encrypted in the cookie. No server-side storage; suitable for small payloads (e.g. user_id). Key should be 32 random bytes for AES-256; any other length is run through HKDF-SHA256 to derive a 32-byte key. Use KeyFromString(APP_KEY) for strings.
func (*CookieStoreImpl) Destroy ¶
func (s *CookieStoreImpl) Destroy(ctx context.Context, id string) error
type DatabaseStore ¶
type DatabaseStore struct {
// contains filtered or unexported fields
}
DatabaseStore stores sessions in a database table. Create the table with: CREATE TABLE sessions (id VARCHAR(64) PRIMARY KEY, payload TEXT, expires_at DATETIME);
func NewDatabaseStore ¶
func NewDatabaseStore(db *lucid.DB, table string) *DatabaseStore
NewDatabaseStore creates a database-backed session store.
func (*DatabaseStore) Destroy ¶
func (s *DatabaseStore) Destroy(ctx context.Context, id string) error
func (*DatabaseStore) EnsureTable ¶
func (s *DatabaseStore) EnsureTable() error
EnsureTable creates the sessions table if it doesn't exist.
type MemoryStore ¶
type MemoryStore struct {
// contains filtered or unexported fields
}
MemoryStore stores sessions in memory. Sessions are lost on restart. Use for development or single-instance apps.
func NewMemoryStore ¶
func NewMemoryStore() *MemoryStore
NewMemoryStore creates an in-memory session store.
type RedisStore ¶
type RedisStore struct {
// contains filtered or unexported fields
}
RedisStore stores sessions in Redis. Suitable for multi-instance deployments. Values are JSON-encoded maps with a TTL based on maxAge.
func NewRedisStore ¶
func NewRedisStore(client *redis.Client) *RedisStore
NewRedisStore creates a Redis-backed session store with the default prefix.
func NewRedisStoreWithPrefix ¶
func NewRedisStoreWithPrefix(client *redis.Client, prefix string) *RedisStore
NewRedisStoreWithPrefix creates a Redis-backed session store with a custom key prefix.
func (*RedisStore) Destroy ¶
func (s *RedisStore) Destroy(ctx context.Context, id string) error
Destroy removes the session.
type Session ¶
type Session struct {
// contains filtered or unexported fields
}
Session provides access to session data.
func FromContext ¶
FromContext returns the session data from the request context. Returns nil if session middleware was not used.
func (*Session) Regenerate ¶
func (s *Session) Regenerate()
Regenerate regenerates the session ID (for security after login).
type SessionRecord ¶
type SessionRecord struct {
ID string `gorm:"primaryKey;size:64"`
Payload string `gorm:"type:text"`
ExpiresAt time.Time `gorm:"index"`
}
SessionRecord is the DB model for sessions.
type Store ¶
type Store interface {
// Get retrieves session data by ID. Returns nil map if not found.
Get(ctx context.Context, id string) (map[string]any, error)
// Set stores session data. id may be empty for new sessions; returns the session ID.
Set(ctx context.Context, id string, data map[string]any, maxAge time.Duration) (string, error)
// Destroy removes the session.
Destroy(ctx context.Context, id string) error
}
Store persists session data. Implementations: MemoryStore, CookieStore, DatabaseStore, RedisStore.
Source Files