Documentation
¶
Overview ¶
Package session provides session store, CSRF token handling, and session cookie options for the web application. It is used by the server package for authentication and form protection.
Index ¶
- Constants
- func ClearSessionCookie(store *sessions.CookieStore, w http.ResponseWriter, r *http.Request)
- func EnsureCsrfToken(store *sessions.CookieStore, w http.ResponseWriter, r *http.Request) string
- func GenerateCSRFToken() string
- func GetSessionOptions(cfg *OptionsConfig) *sessions.Options
- func IsAuthenticated(store *sessions.CookieStore, w http.ResponseWriter, r *http.Request) bool
- func ValidateCsrfToken(store *sessions.CookieStore, r *http.Request) bool
- type Manager
- func (m *Manager) ClearSession(w http.ResponseWriter, r *http.Request)
- func (m *Manager) EnsureCSRFToken(w http.ResponseWriter, r *http.Request) string
- func (m *Manager) GetOptions() *sessions.Options
- func (m *Manager) GetSession(w http.ResponseWriter, r *http.Request) (*sessions.Session, error)
- func (m *Manager) IsAuthenticated(r *http.Request) bool
- func (m *Manager) SaveSession(w http.ResponseWriter, r *http.Request, sess *sessions.Session) error
- func (m *Manager) SetAuthenticated(w http.ResponseWriter, r *http.Request, authenticated bool) error
- func (m *Manager) ValidateCSRFToken(r *http.Request) bool
- type OptionsConfig
- type SessionManager
- type User
Constants ¶
const SessionName = "session-name"
SessionName is the canonical cookie name used across the application.
Variables ¶
This section is empty.
Functions ¶
func ClearSessionCookie ¶
func ClearSessionCookie(store *sessions.CookieStore, w http.ResponseWriter, r *http.Request)
ClearSessionCookie removes the session cookie using the store options so path/domain/flags match and browsers drop it. Per RFC 6265, Domain is only set for domain names, not for IP addresses.
func EnsureCsrfToken ¶
func EnsureCsrfToken(store *sessions.CookieStore, w http.ResponseWriter, r *http.Request) string
EnsureCsrfToken ensures a CSRF token exists in the session and returns it. If none is present, it generates a new one. If the session cookie is invalid (e.g., after secret rotation), the cookie is cleared and a new session is used.
func GenerateCSRFToken ¶ added in v0.7.0
func GenerateCSRFToken() string
GenerateCSRFToken generates a cryptographically random CSRF token. It does NOT save the token to any session; callers must persist it themselves if needed. Use this for ephemeral tokens on public pages where emitting a Set-Cookie is undesirable.
func GetSessionOptions ¶
func GetSessionOptions(cfg *OptionsConfig) *sessions.Options
GetSessionOptions returns session cookie options from cfg. If cfg is nil, defaults are used.
func IsAuthenticated ¶ added in v0.5.0
func IsAuthenticated(store *sessions.CookieStore, w http.ResponseWriter, r *http.Request) bool
IsAuthenticated reports whether the request has a valid authenticated session. If the session cookie is invalid or malformed, it clears the cookie and returns false.
func ValidateCsrfToken ¶
func ValidateCsrfToken(store *sessions.CookieStore, r *http.Request) bool
ValidateCsrfToken checks the CSRF token in the request form against the session. Returns false if the session has no token or the form token is missing or doesn't match.
Types ¶
type Manager ¶
type Manager struct {
// contains filtered or unexported fields
}
Manager implements SessionManager by wrapping a session store and providing access to session configuration. The configGetter function is called to retrieve the current OptionsConfig whenever GetOptions() is invoked.
func NewManager ¶
func NewManager(store *sessions.CookieStore, configGetter func() *OptionsConfig) *Manager
NewManager creates a new SessionManager implementation. The configGetter function is called each time GetOptions() is invoked to get the current session configuration. This allows the manager to respond to configuration changes without requiring explicit updates.
func (*Manager) ClearSession ¶
func (m *Manager) ClearSession(w http.ResponseWriter, r *http.Request)
ClearSession removes the session cookie by setting a max-age=-1 cookie with matching name, path, secure, and http-only flags.
func (*Manager) EnsureCSRFToken ¶
EnsureCSRFToken ensures a CSRF token exists in the session and returns it. If none is present, it generates a new one. If the session cookie is invalid (e.g., after secret rotation), the cookie is cleared and a new session is used.
func (*Manager) GetOptions ¶
GetOptions returns the current session cookie options by calling GetSessionOptions with the configuration provided by the configGetter function.
func (*Manager) GetSession ¶
GetSession retrieves the session from the request. If the session cookie is invalid, it clears the cookie from the browser and returns a fresh session.
func (*Manager) IsAuthenticated ¶
IsAuthenticated returns true if the user is authenticated.
func (*Manager) SaveSession ¶
SaveSession saves the session to the response.
func (*Manager) SetAuthenticated ¶
func (m *Manager) SetAuthenticated(w http.ResponseWriter, r *http.Request, authenticated bool) error
SetAuthenticated sets the authenticated status for the session. On a false -> true transition (login) the session ID is rotated to mitigate session fixation: a new session is created and user values are copied over.
type OptionsConfig ¶
type OptionsConfig struct {
SessionMaxAge int
SessionHttpOnly bool
SessionSecure bool
SessionSameSite string
}
OptionsConfig holds session cookie configuration. When nil is passed to GetSessionOptions, defaults are used with env overrides (SEPG_SESSION_HTTPONLY, SEPG_SESSION_SECURE).
type SessionManager ¶
type SessionManager interface {
GetOptions() *sessions.Options
EnsureCSRFToken(w http.ResponseWriter, r *http.Request) string
ValidateCSRFToken(r *http.Request) bool
ClearSession(w http.ResponseWriter, r *http.Request)
// GetSession retrieves the session from the request.
// If the session cookie is invalid, it clears the cookie and returns a new session.
GetSession(w http.ResponseWriter, r *http.Request) (*sessions.Session, error)
// SaveSession saves the session to the response.
SaveSession(w http.ResponseWriter, r *http.Request, sess *sessions.Session) error
// IsAuthenticated returns true if the user is authenticated.
IsAuthenticated(r *http.Request) bool
// SetAuthenticated sets the authenticated status for the session.
SetAuthenticated(w http.ResponseWriter, r *http.Request, authenticated bool) error
}
SessionManager provides an interface for session management operations. It encapsulates session store access, CSRF token handling, and session options.
Source Files