Documentation
¶
Overview ¶
Package session provides signed-ID, server-side HTTP sessions. Session data is never placed in the cookie, and applications can replace the backing Store.
Index ¶
- Variables
- type Cookie
- type Manager
- func (manager *Manager) Destroy(ctx context.Context, response http.ResponseWriter, session *Session) error
- func (manager *Manager) Invalidate(ctx context.Context, response http.ResponseWriter, session *Session) error
- func (manager *Manager) Load(ctx context.Context, request *http.Request) (*Session, error)
- func (manager *Manager) Regenerate(_ context.Context, session *Session) error
- func (manager *Manager) RegenerateOrCreate(_ context.Context, session *Session) error
- func (manager *Manager) Save(ctx context.Context, response http.ResponseWriter, session *Session) error
- type MemoryStore
- func (store *MemoryStore) Create(_ context.Context, id string, value []byte, expiresAt time.Time) error
- func (store *MemoryStore) Delete(_ context.Context, id string) error
- func (store *MemoryStore) Get(_ context.Context, id string) ([]byte, error)
- func (store *MemoryStore) Rotate(_ context.Context, oldID, newID string, value []byte, expiresAt time.Time) error
- func (store *MemoryStore) Update(_ context.Context, id string, value []byte, expiresAt time.Time) error
- type Policy
- type Session
- type Store
Constants ¶
This section is empty.
Variables ¶
var ( ErrNotFound = errors.New("session not found") ErrExists = errors.New("session already exists") )
Functions ¶
This section is empty.
Types ¶
type Manager ¶
type Manager struct {
// contains filtered or unexported fields
}
func NewManager ¶
func NewManager(store Store, secret []byte, cookie Cookie, lifetime time.Duration) (*Manager, error)
NewManager retains the original sliding-lifetime behavior. Applications that need a hard session deadline should use NewManagerWithPolicy.
func NewManagerWithPolicy ¶ added in v0.8.0
func NewManagerWithPolicy(store Store, secret []byte, cookie Cookie, policy Policy) (*Manager, error)
NewManagerWithPolicy constructs a manager with explicit idle and absolute lifetimes. Session issuance is persisted in the server-side payload; changing or rotating the signed cookie cannot extend the absolute deadline.
func (*Manager) Invalidate ¶ added in v0.8.0
func (manager *Manager) Invalidate(ctx context.Context, response http.ResponseWriter, session *Session) error
Invalidate removes a server-side session without writing a cookie. It is intended for stale authenticated requests: a late deletion cookie from one response must not overwrite a newly rotated cookie from a concurrent winning response in the same browser. Explicit logout should continue to use Destroy.
func (*Manager) Regenerate ¶
Regenerate stages a new ID while retaining values. Save atomically replaces a persisted old ID and sends the new cookie, typically after authentication. The context parameter is retained for API compatibility; persistence happens only in Save so a failed replacement cannot destroy the current session.
func (*Manager) RegenerateOrCreate ¶ added in v0.8.0
RegenerateOrCreate stages a new ID whose save may create the new row if a concurrent request removed the old one. Use this only after an independent, durable authorization change has already succeeded (for example a password compare-and-swap); ordinary rotations must use Regenerate and fail closed.
type MemoryStore ¶
type MemoryStore struct {
// contains filtered or unexported fields
}
MemoryStore is an in-process store intended for development and tests. Entries are removed on expired reads; restarting the process loses sessions.
func NewMemoryStore ¶
func NewMemoryStore() *MemoryStore
type Policy ¶ added in v0.8.0
Policy controls how long a session may remain idle and how long it may exist in total. AbsoluteLifetime zero disables the absolute deadline. When enabled, it must be at least IdleLifetime so the two expiration rules remain legible.
type Session ¶
type Session struct {
// contains filtered or unexported fields
}
Session holds one request's mutable state and is not safe for concurrent use. Obtain sessions through Manager.Load and persist changes with Manager.Save.
type Store ¶
type Store interface {
Get(context.Context, string) ([]byte, error)
Create(context.Context, string, []byte, time.Time) error
Update(context.Context, string, []byte, time.Time) error
Rotate(context.Context, string, string, []byte, time.Time) error
Delete(context.Context, string) error
}
Store persists sessions until their expiry. Create must return ErrExists when an ID is already present. Get and Update must return ErrNotFound for missing or expired IDs. Rotate must atomically replace oldID with newID, returning ErrNotFound when oldID is no longer current and ErrExists when newID already exists. Implementations must be safe for concurrent use.
Source Files