Documentation
¶
Overview ¶
Package session provides typed, encrypted, stateless HTTP sessions with explicit key rotation and secure cookie defaults.
Index ¶
Examples ¶
Constants ¶
This section is empty.
Variables ¶
View Source
var ( // ErrNotFound means the request carries no configured session cookie. ErrNotFound = errors.New("session not found") // ErrInvalid means a cookie is malformed, unauthenticated, or violates the // configured bounded session contract. ErrInvalid = errors.New("session is invalid") // ErrExpired means an authenticated session reached its embedded expiry. ErrExpired = errors.New("session expired") )
Functions ¶
This section is empty.
Types ¶
type Key ¶
Key is one AES-256-GCM key. The first configured key seals new sessions; remaining keys only decrypt sessions during bounded rotation.
type Manager ¶
type Manager[T any] struct { // contains filtered or unexported fields }
Manager seals and loads one exact session value type. It is safe for concurrent use.
Example ¶
type claims struct {
Subject string `json:"subject"`
}
manager, err := New[claims](Options{
Name: "__Host-orders",
Keys: []Key{{
ID: "2026-07",
Secret: []byte("0123456789abcdef0123456789abcdef"),
}},
})
if err != nil {
panic(err)
}
recorder := httptest.NewRecorder()
if err := manager.Save(
recorder,
claims{Subject: "account-41"},
sessionNow,
); err != nil {
panic(err)
}
fmt.Println(len(recorder.Header().Values("Set-Cookie")))
Output: 1
func New ¶
New validates and freezes a typed session manager without reading process state or generating a token.
func (*Manager[T]) Clear ¶
func (manager *Manager[T]) Clear(writer http.ResponseWriter) error
Clear appends a cookie deletion header with the manager's exact security and scope attributes.
Source Files
Click to show internal directories.
Click to hide internal directories.