Documentation
¶
Overview ¶
Package session creates, validates, extends, and revokes login sessions.
A session is identified by a random token (see internal/token) that's given to the client once. Only the token's SHA-256 hash is stored, so a database leak doesn't expose working sessions.
Expiry follows the auth standard (§4): a session ends after a period of inactivity (idle timeout) and, regardless of activity, after a maximum lifetime. Activity pushes the idle expiry forward, but only once per ExtendAfter interval, to avoid a database write on every request.
Index ¶
- Constants
- Variables
- type Client
- type Manager
- func (m *Manager) Create(ctx context.Context, userID uuid.UUID, meta Meta, p Policy) (string, Session, error)
- func (m *Manager) DeleteExpired(ctx context.Context) (int64, error)
- func (m *Manager) List(ctx context.Context, userID uuid.UUID) ([]Session, error)
- func (m *Manager) Revoke(ctx context.Context, userID, sessionID uuid.UUID) error
- func (m *Manager) RevokeAll(ctx context.Context, userID uuid.UUID) (int64, error)
- func (m *Manager) RevokeOthers(ctx context.Context, userID, keepID uuid.UUID) (int64, error)
- func (m *Manager) Validate(ctx context.Context, tok string) (Session, error)
- type Meta
- type Policy
- type Session
Constants ¶
const ExtendAfter = 24 * time.Hour
ExtendAfter is how long after the last extension a session must be used before its idle expiry is pushed forward again.
Variables ¶
var ( // ErrInvalid means a token doesn't identify a usable session: it's // malformed, unknown, revoked, or expired. These cases are deliberately // indistinguishable to callers. ErrInvalid = errors.New("session is invalid or expired") // ErrNotFound means a session to revoke doesn't exist or doesn't belong // to the given user. ErrNotFound = errors.New("session not found") )
var ( // Standard is for regular users: 30 days idle, 90 days at most. Standard = Policy{IdleTimeout: 30 * 24 * time.Hour, MaxLifetime: 90 * 24 * time.Hour} // Privileged is for users with admin or elevated roles: 12 hours. Privileged = Policy{IdleTimeout: 12 * time.Hour, MaxLifetime: 12 * time.Hour} )
Functions ¶
This section is empty.
Types ¶
type Manager ¶
type Manager struct {
// contains filtered or unexported fields
}
Manager manages sessions in the database.
func NewManager ¶
NewManager returns a Manager using conn, which may be a pool or a transaction. now supplies the current time; pass time.Now outside tests.
func (*Manager) Create ¶
func (m *Manager) Create(ctx context.Context, userID uuid.UUID, meta Meta, p Policy) (string, Session, error)
Create starts a new session for userID and returns its token. The token is returned only here and must be given to the client; it can't be recovered later.
func (*Manager) DeleteExpired ¶
DeleteExpired removes every expired session and returns how many were removed. Run it periodically; expired sessions are already rejected by Validate, so this only frees space.
func (*Manager) List ¶
List returns userID's sessions that haven't expired, most recently used first.
func (*Manager) Revoke ¶
Revoke ends one of userID's sessions. It returns ErrNotFound if the session doesn't exist or belongs to someone else.
func (*Manager) RevokeAll ¶
RevokeAll ends every session userID has ("log out everywhere"), and returns how many were ended.
func (*Manager) RevokeOthers ¶
RevokeOthers ends every session userID has except keepID, e.g. after a password change made from that session. It returns how many were ended.
Source Files