github.com/decred/politeia@v1.4.0/politeiawww/sessions/doc.go (about)

     1  // Copyright (c) 2021 The Decred developers
     2  // Use of this source code is governed by an ISC
     3  // license that can be found in the LICENSE file.
     4  
     5  /*
     6  Package sessions implements a custom session store that uses the
     7  gorilla/sessions and gorilla/securecookie libraries.
     8  
     9  The only session store methods that the caller needs to use are Get() and
    10  Save().
    11  
    12  The caller uses Get() to initialize a new session.
    13  
    14  The caller can save application specific key-value data to the session by
    15  saving it to the Values field. This data is never sent to the client. It's
    16  saved to the databse as an encoded string and can be retrieved using the
    17  session ID.
    18  
    19  The caller uses Save() to save the encoded session values to the database and
    20  to save the encoded session ID to the http response cookies.
    21  
    22  On future requests, the encoded session ID is provided by the client in the
    23  request cookie. The caller uses Get() to decode the session ID and to lookup
    24  the session values from the database.
    25  
    26  Session values can be deleted from the database by saving the session with a
    27  MaxAge of <= 0.
    28  
    29  The key used to encode/decode the session ID and the session values is provided
    30  to the session store on initialization. Keys can be rotated by providing
    31  multiple keys on initialization.
    32  
    33  The session store does not delete expired sessions from the database. The
    34  gorilla/sessions API does not allow the session ID to be retrieved from a
    35  session cookie once the session has expired, so there is no way for the session
    36  store to know what IDs needs to be deleted from the database. The database
    37  layer must track when the session was created and manually delete expired
    38  sessions.
    39  */
    40  package sessions