Documentation
¶
Index ¶
- Variables
- func NewID() (string, error)
- type Config
- type Manager
- type MemoryStore
- type Session
- func (s *Session) Delete(key string)
- func (s *Session) Get(key string) (any, bool)
- func (s *Session) ID() string
- func (s *Session) Invalidate()
- func (s *Session) IsInvalidated() bool
- func (s *Session) IsModified() bool
- func (s *Session) IsRotated() bool
- func (s *Session) OldID() string
- func (s *Session) Rotate() error
- func (s *Session) Set(key string, value any)
- type Store
Constants ¶
This section is empty.
Variables ¶
var ErrSessionNotFound = errors.New("session not found")
ErrSessionNotFound is returned by Store.Get when no session exists for the given ID.
Functions ¶
Types ¶
type Config ¶
type Config struct {
// CookieName is the name of the session cookie. Default: "arx_session".
CookieName string
// MaxAge is how long a session lives before it expires. Default: 24 hours.
MaxAge time.Duration
// Secure instructs the browser to send the cookie only over HTTPS.
// Set to false only in local development. Default: true.
Secure bool
// HttpOnly prevents JavaScript from reading the cookie. Always keep this true.
HttpOnly bool
// SameSite controls cross-site cookie sending. Default: SameSiteStrictMode.
SameSite http.SameSite
// Path is the URL path scope for the cookie. Default: "/".
Path string
}
Config holds the cookie and session lifetime settings for a Manager. Use DefaultConfig() and override only what you need.
func DefaultConfig ¶
func DefaultConfig() Config
DefaultConfig returns a secure-by-default session configuration.
type Manager ¶
type Manager struct {
// contains filtered or unexported fields
}
Manager handles session creation, loading, signing, and persistence. Create one with New() and apply its middleware to your app.
func New ¶
New creates a Manager with the given secret key, store, and config. secretKey must be at least 32 bytes — it is used for HMAC-SHA256 session ID signing. Never hardcode this value; load it from an environment variable or secret manager.
func (*Manager) Middleware ¶
func (m *Manager) Middleware() arx.Middleware
Middleware returns an arx.Middleware that loads the session on the way in and saves, rotates, or invalidates it on the way out.
type MemoryStore ¶
type MemoryStore struct {
// contains filtered or unexported fields
}
MemoryStore is an in-process session store backed by a map. It is safe for concurrent use. Expired entries are removed lazily on Get. For production use with multiple processes or servers, use a shared store (e.g., Redis).
func NewMemoryStore ¶
func NewMemoryStore() *MemoryStore
NewMemoryStore creates an empty MemoryStore.
type Session ¶
type Session struct {
// contains filtered or unexported fields
}
Session holds the data for a single user session. The session ID lives in an HMAC-signed cookie; everything else stays server-side.
func FromRequest ¶
FromRequest retrieves the session attached to the current request. Returns nil if the session middleware was not applied.
func MustFromRequest ¶
MustFromRequest retrieves the session from the request context. Panics if the session middleware was not applied — use this in handlers where the middleware is always present. Use FromRequest when you need nil-safety.
func NewSession ¶
NewSession creates a Session with the given ID and an empty value map. Used internally by the Manager when loading or creating sessions.
func (*Session) Delete ¶
Delete removes key from the session and marks it as modified. Deleting a key that does not exist is a no-op.
func (*Session) Invalidate ¶
func (s *Session) Invalidate()
Invalidate marks the session for deletion. The middleware will delete it from the store and clear the cookie after the handler returns. Use this on logout.
func (*Session) IsInvalidated ¶
IsInvalidated reports whether Invalidate has been called on this session.
func (*Session) IsModified ¶
IsModified reports whether any values have been set or deleted since the session was loaded.
func (*Session) OldID ¶
OldID returns the session ID before the last Rotate call. Returns an empty string if the session has not been rotated.
type Store ¶
type Store interface {
// Get retrieves the session by ID. Returns ErrSessionNotFound if absent or expired.
Get(ctx context.Context, id string) (*Session, error)
// Save persists the session with the given TTL.
Save(ctx context.Context, s *Session, ttl time.Duration) error
// Delete removes the session by ID. No-op if it does not exist.
Delete(ctx context.Context, id string) error
}
Store is the interface a session backend must implement. The default is MemoryStore. Implement this interface to use Redis, Postgres, etc.
Source Files