Documentation
¶
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func CSRF ¶
CSRF is middleware that protects against cross-site request forgery.
It uses the HMAC double-submit cookie pattern: a token is generated from a random nonce HMAC-signed with the session ID, set as a JS-readable cookie, and must be echoed back in the X-CSRF-TOKEN header on state-changing requests.
Safe methods (GET, HEAD, OPTIONS) pass through with a token cookie set. Requests with an Authorization: Bearer header are skipped (API clients).
func Destroy ¶
Destroy deletes the current session from the database and returns expired cookies that clear the session and CSRF cookies in the browser.
Types ¶
type Driver ¶
type Driver struct {
// contains filtered or unexported fields
}
Driver implements session-based authentication using database-backed sessions. Sessions are identified by a cookie. The session record is looked up in the sessions table and validated for expiry.
func NewDriver ¶
NewDriver creates a session auth driver. Config is read from environment:
- SESSION_COOKIE: cookie name (default: "session_id")
- SESSION_TTL: session lifetime in seconds (default: 86400)
func (*Driver) Authenticate ¶
Authenticate reads the session cookie, looks up the session in the database, and returns AuthInfo on success.
func (*Driver) CookieName ¶
CookieName returns the configured session cookie name.
type SessionCookies ¶
SessionCookies holds the cookies that should be set after session creation.
func Create ¶
func Create(ctx *pickle.Context, userID, role string) (*SessionCookies, error)
Create inserts a new session into the database and returns a Response with session and CSRF cookies set. The caller should chain this onto their response:
resp, err := session.Create(ctx, userID, role)
if err != nil { return ctx.Error(err) }
return ctx.JSON(200, data).WithCookie(resp.Session).WithCookie(resp.CSRF)
Source Files