Documentation
¶
Overview ¶
Package session provides server-side session management for OniWorks. The default store is Oni Memory (in-process, fast). A database store is also available.
Index ¶
- Variables
- type Config
- type Manager
- type Session
- func (s *Session) Delete(key string)
- func (s *Session) Flash(key string, value any)
- func (s *Session) Get(key string) (any, bool)
- func (s *Session) GetFlash(key string) (any, bool)
- func (s *Session) Has(key string) bool
- func (s *Session) IsNew() bool
- func (s *Session) Regenerate(ctx context.Context) error
- func (s *Session) Set(key string, value any)
- type Store
Constants ¶
This section is empty.
Variables ¶
var ErrNotFound = errors.New("session: not found")
ErrNotFound is returned by Store.Get when no session exists for the given ID (or it has expired). It lets the Manager distinguish "no session" — which should transparently create a fresh one — from a real store failure, which must be surfaced instead of silently logging users out.
Functions ¶
This section is empty.
Types ¶
type Config ¶
type Config struct {
CookieName string
Domain string
Path string
Secure bool
HTTPOnly bool
SameSite http.SameSite
TTL time.Duration
}
Config holds session configuration.
func DefaultConfig ¶
func DefaultConfig() Config
DefaultConfig returns production-safe session defaults.
type Manager ¶
type Manager struct {
// contains filtered or unexported fields
}
Manager manages session lifecycle.
func NewManager ¶
NewManager creates a session Manager.
func (*Manager) Save ¶
Save persists the session data to the store. Call this at the end of each request.
func (*Manager) Start ¶
func (m *Manager) Start(ctx context.Context, r *http.Request, w http.ResponseWriter) (*Session, error)
Start reads or creates the session for the current request. A missing or expired session transparently creates a fresh one; a store failure (e.g. a transient backend outage) is returned as an error so callers don't silently log users out.
type Session ¶
type Session struct {
ID string
// contains filtered or unexported fields
}
Session represents a single user session.
func (*Session) Regenerate ¶
Regenerate rotates the session ID while preserving the session data. Call it on any privilege change — especially after login — to prevent session fixation, where an attacker fixes a victim's pre-auth session ID and reuses it once authenticated. The new ID is written to the cookie on the next Save.
type Store ¶
type Store interface {
// Get returns the session data for id. When no session exists (or it has
// expired) it should return ErrNotFound; returning (nil, nil) is also
// accepted for backward compatibility. Any other error is treated as a
// store failure and propagated to the caller.
Get(ctx context.Context, id string) (map[string]any, error)
Set(ctx context.Context, id string, data map[string]any, ttl time.Duration) error
Delete(ctx context.Context, id string) error
Regenerate(ctx context.Context, oldID string) (string, error)
}
Store is the interface all session stores must implement.
Source Files
Directories