Documentation
¶
Index ¶
- Constants
- func RegenerateSession(sessionManager *scs.SessionManager, w http.ResponseWriter, r *http.Request) error
- func SecureSessionRotationMiddleware(sessionManager *scs.SessionManager, config SecureSessionConfig) func(next http.Handler) http.Handler
- type AuthSessionHandler
- type SecureSessionConfig
- type Session
Constants ¶
const ( KeyUserID = "userID" KeyAuthTime = "auth_time" KeyCreatedAt = "created_at" KeyFingerprint = "fingerprint" )
Session keys written by AuthSessionHandler.
KeyUserID is "userID" to match the rest of the framework: render.defaultData derives IsAuthenticated from it, and the scaffolded auth middleware, TOTP handlers and remember-me middleware all read it. This handler used to write "user_id" instead, so the two mechanisms could never see each other's sessions -- an application using LoginUser appeared logged out to every template and middleware in the same app.
Variables ¶
This section is empty.
Functions ¶
func RegenerateSession ¶
func RegenerateSession(sessionManager *scs.SessionManager, w http.ResponseWriter, r *http.Request) error
RegenerateSession regenerates session ID to prevent fixation attacks
func SecureSessionRotationMiddleware ¶
func SecureSessionRotationMiddleware(sessionManager *scs.SessionManager, config SecureSessionConfig) func(next http.Handler) http.Handler
SecureSessionRotationMiddleware provides automatic session rotation
Types ¶
type AuthSessionHandler ¶
type AuthSessionHandler struct {
// contains filtered or unexported fields
}
AuthSessionHandler handles authentication-related session operations.
It writes the keys declared above, which are the same ones the rest of the framework reads, so LoginUser and hand-rolled session handling can coexist.
func AuthenticationSessionHandler ¶
func AuthenticationSessionHandler(sessionManager *scs.SessionManager, config SecureSessionConfig) *AuthSessionHandler
AuthenticationSessionHandler handles secure session operations for authentication
func (*AuthSessionHandler) LoginUser ¶
func (ash *AuthSessionHandler) LoginUser(w http.ResponseWriter, r *http.Request, userID string) error
LoginUser securely establishes user session after authentication
func (*AuthSessionHandler) LogoutUser ¶
func (ash *AuthSessionHandler) LogoutUser(w http.ResponseWriter, r *http.Request) error
LogoutUser securely destroys user session
func (*AuthSessionHandler) ValidateSession ¶
func (ash *AuthSessionHandler) ValidateSession(r *http.Request) bool
ValidateSession validates session integrity and security
type SecureSessionConfig ¶
type SecureSessionConfig struct {
EnableRotation bool
RotateOnAuth bool
MaxLifetime time.Duration
IdleTimeout time.Duration
RegenerationTime time.Duration
HttpOnlyDefault bool
SecureDefault bool
SameSiteDefault http.SameSite
}
SecureSessionConfig holds secure session configuration
func DefaultSecureSessionConfig ¶
func DefaultSecureSessionConfig() SecureSessionConfig
DefaultSecureSessionConfig returns secure default configuration
type Session ¶
type Session struct {
// DBType names the driver behind DBPool, so SESSION_TYPE=database can
// resolve to the right store.
DBType string
CookieLifetime string
CookiePersist string
CookieName string
CookieDomain string
SessionType string
CookieSecure string
DBPool *sql.DB
RedisPool *redis.Pool
}
func (*Session) InitSecureSession ¶
func (g *Session) InitSecureSession(config SecureSessionConfig) (*scs.SessionManager, error)
InitSecureSession creates a session manager with enhanced security.
It returns an error for a session type it cannot serve. Falling through to an in-memory store meant SESSION_TYPE=database -- a value the config layer explicitly accepts -- silently produced sessions that vanished on restart and broke behind a second replica, with no warning anywhere.
func (*Session) InitSession ¶
func (g *Session) InitSession() (*scs.SessionManager, error)
InitSession creates a session manager from the Session's own fields.
Source Files