Documentation
¶
Overview ¶
Package session provides session store, session cookie options, and authentication helpers for the web application. It is used by the server package for authentication and session management.
Index ¶
- Constants
- func ClearSessionCookie(store *sessions.CookieStore, w http.ResponseWriter, r *http.Request)
- func GetSessionOptions(cfg *OptionsConfig) *sessions.Options
- func IsAuthenticated(store *sessions.CookieStore, w http.ResponseWriter, r *http.Request) bool
- type Manager
- func (m *Manager) ClearSession(w http.ResponseWriter, r *http.Request)
- func (m *Manager) GetOptions() *sessions.Options
- func (m *Manager) GetSession(w http.ResponseWriter, r *http.Request) (*sessions.Session, error)
- func (m *Manager) IsAuthenticated(w http.ResponseWriter, r *http.Request) bool
- func (m *Manager) SaveSession(w http.ResponseWriter, r *http.Request, sess *sessions.Session) error
- func (m *Manager) SetAuthenticated(w http.ResponseWriter, r *http.Request, authenticated bool) error
- type OptionsConfig
- type SessionManager
- type User
Constants ¶
const SessionName = "session-name"
SessionName is the canonical cookie name used across the application.
Variables ¶
This section is empty.
Functions ¶
func ClearSessionCookie ¶
func ClearSessionCookie(store *sessions.CookieStore, w http.ResponseWriter, r *http.Request)
ClearSessionCookie removes the session cookie using the store options so path/domain/flags match and browsers drop it. Per RFC 6265, Domain is only set for domain names, not for IP addresses.
func GetSessionOptions ¶
func GetSessionOptions(cfg *OptionsConfig) *sessions.Options
GetSessionOptions returns session cookie options from cfg. If cfg is nil, defaults are used.
func IsAuthenticated ¶ added in v0.5.0
func IsAuthenticated(store *sessions.CookieStore, w http.ResponseWriter, r *http.Request) bool
IsAuthenticated reports whether the request has a valid authenticated session. If the session cookie is invalid or malformed, it clears the cookie and returns false.
Types ¶
type Manager ¶
type Manager struct {
// contains filtered or unexported fields
}
Manager implements SessionManager by wrapping a session store and providing access to session configuration. The configGetter function is called to retrieve the current OptionsConfig whenever GetOptions() is invoked.
func NewManager ¶
func NewManager(store *sessions.CookieStore, configGetter func() *OptionsConfig) *Manager
NewManager creates a new SessionManager implementation. The configGetter function is called each time GetOptions() is invoked to get the current session configuration. This allows the manager to respond to configuration changes without requiring explicit updates.
func (*Manager) ClearSession ¶
func (m *Manager) ClearSession(w http.ResponseWriter, r *http.Request)
ClearSession removes the session cookie by setting a max-age=-1 cookie with matching name, path, secure, and http-only flags.
func (*Manager) GetOptions ¶
GetOptions returns the current session cookie options by calling GetSessionOptions with the configuration provided by the configGetter function.
func (*Manager) GetSession ¶
GetSession retrieves the session from the request. If the session cookie is invalid, it clears the cookie from the browser and returns a fresh session.
func (*Manager) IsAuthenticated ¶
IsAuthenticated returns true if the user is authenticated. If the session cookie is invalid or malformed, it clears the cookie from the browser and returns false. This aligns with the auth middleware and the package-level IsAuthenticated function.
func (*Manager) SaveSession ¶
SaveSession saves the session to the response.
func (*Manager) SetAuthenticated ¶
func (m *Manager) SetAuthenticated(w http.ResponseWriter, r *http.Request, authenticated bool) error
SetAuthenticated sets the authenticated status for the session. On a false -> true transition (login) the session ID is rotated to mitigate session fixation: a new session is created and user values are copied over.
type OptionsConfig ¶
type OptionsConfig struct {
SessionMaxAge int
SessionHttpOnly bool
SessionSecure bool
SessionSameSite string
}
OptionsConfig holds session cookie configuration. When nil is passed to GetSessionOptions, defaults are used with env overrides (SEPG_SESSION_HTTPONLY, SEPG_SESSION_SECURE).
type SessionManager ¶
type SessionManager interface {
GetOptions() *sessions.Options
ClearSession(w http.ResponseWriter, r *http.Request)
// GetSession retrieves the session from the request.
// If the session cookie is invalid, it clears the cookie and returns a new session.
GetSession(w http.ResponseWriter, r *http.Request) (*sessions.Session, error)
// SaveSession saves the session to the response.
SaveSession(w http.ResponseWriter, r *http.Request, sess *sessions.Session) error
// IsAuthenticated returns true if the user is authenticated.
// If the session cookie is invalid or malformed, it clears the cookie and
// returns false.
IsAuthenticated(w http.ResponseWriter, r *http.Request) bool
// SetAuthenticated sets the authenticated status for the session.
SetAuthenticated(w http.ResponseWriter, r *http.Request, authenticated bool) error
}
SessionManager provides an interface for session management operations.
Source Files