Documentation
¶
Overview ¶
Package valkeystate keeps the state that must agree across backend processes and is touched on every sign-in in Valkey (or any Redis-compatible server) instead of the database: the failed attempt counters and the single-use nonces. It is optional. Without it the same state lives in the database tables (used_nonces, auth_failures), so a flood of wrong passwords turns into database writes; with it the flood costs the database nothing.
It has the same methods and meaning as the store's, so the backend uses either one. Every operation has a time limit, and every error is returned: the backend fails closed on them (an address counts as locked out, a nonce as spent), exactly as it does when the database fails.
Nothing here is evicted quietly. The server must run with maxmemory-policy noeviction: a counter or a nonce that was evicted would let an attacker try again, or replay a value, so a full server must refuse writes (which fails closed) instead.
Index ¶
- type Client
- func (v *Client) ClearFailures(ctx context.Context, key string) error
- func (v *Client) Close()
- func (v *Client) CountFailures(ctx context.Context, key string, since time.Time) (int, error)
- func (v *Client) CountSessions(ctx context.Context) (int64, error)
- func (v *Client) CreateSession(ctx context.Context, tokenHash string, userID int64, method string, ...) error
- func (v *Client) DeleteSession(ctx context.Context, tokenHash string) error
- func (v *Client) DeleteUserSessions(ctx context.Context, userID int64) error
- func (v *Client) GetSession(ctx context.Context, tokenHash string) (models.Session, error)
- func (v *Client) NonceSeen(ctx context.Context, nonce string) (bool, error)
- func (v *Client) Ping(ctx context.Context) error
- func (v *Client) RecordFailure(ctx context.Context, key string, at time.Time) error
- func (v *Client) UseNonce(ctx context.Context, nonce string, expires time.Time) (bool, error)
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Client ¶
type Client struct {
// contains filtered or unexported fields
}
Client talks to the server. Its methods are safe for concurrent use.
func Open ¶
Open connects to the server at rawURL (redis://[:password@]host:port[/db], or rediss:// for TLS) and checks that it answers.
func (*Client) ClearFailures ¶
ClearFailures forgets the failures under key, after a success.
func (*Client) CountFailures ¶
CountFailures counts the failures under key that are newer than since.
func (*Client) CountSessions ¶
CountSessions returns how many sessions are alive.
func (*Client) CreateSession ¶
func (v *Client) CreateSession(ctx context.Context, tokenHash string, userID int64, method string, expires time.Time) error
CreateSession stores a session until expires.
func (*Client) DeleteSession ¶
DeleteSession ends one session. A session that does not exist is not an error.
func (*Client) DeleteUserSessions ¶
DeleteUserSessions ends every session of one user. Only the sessions seen at the start are removed from the index, so one that is created at the same moment stays reachable by the next call.
func (*Client) GetSession ¶
GetSession returns an unexpired session, or store.ErrNotFound.
func (*Client) RecordFailure ¶
RecordFailure notes a failed attempt under key.
Source Files