Struct SessionAuthenticator 

pub struct SessionAuthenticator { /* private fields */ }

Session-based authenticator.

Reads user information from the actix-session.

Spring Security Equivalent

Similar to Spring’s session-based authentication where SecurityContext is stored in the HttpSession.

Requirements

• SessionMiddleware must be configured in your application
• User must be logged in via SessionAuthenticator::login()

Example

use actix_security_core::http::security::session::{SessionAuthenticator, SessionConfig};

let config = SessionConfig::new()
    .fixation_strategy(SessionFixationStrategy::MigrateSession);
let authenticator = SessionAuthenticator::new(config);

// In login handler
async fn login(session: Session, form: Form<LoginForm>) -> impl Responder {
    // Validate credentials...
    let user = validate_user(&form.username, &form.password)?;

    // Store user in session (with fixation protection)
    SessionAuthenticator::login(&session, &user, &config)?;

    HttpResponse::Ok().body("Logged in")
}

Implementations

impl SessionAuthenticator

pub fn new(config: SessionConfig) -> SessionAuthenticator

Create a new session authenticator.

pub fn default_config() -> SessionAuthenticator

Create with default configuration.

pub fn login( session: &Session, user: &User, config: &SessionConfig, ) -> Result<(), SessionError>

Store user in session (login) with session fixation protection.

This method:

1. Applies session fixation protection based on configuration
2. Stores user data in the session
3. Sets the authenticated flag

Spring Equivalent

Similar to SecurityContextHolder.getContext().setAuthentication(...) combined with session fixation protection.

Example

async fn login_handler(
    session: Session,
    form: Form<LoginForm>,
    config: Data<SessionConfig>,
) -> impl Responder {
    // Validate credentials
    let user = validate_user(&form.username, &form.password)?;

    // Login with session fixation protection
    SessionAuthenticator::login(&session, &user, &config)?;

    HttpResponse::Ok().body("Logged in")
}

pub fn logout(session: &Session, config: &SessionConfig)

Remove user from session (logout).

Example

async fn logout_handler(session: Session, config: Data<SessionConfig>) -> impl Responder {
    SessionAuthenticator::logout(&session, &config);
    HttpResponse::Ok().body("Logged out")
}

pub fn clear_session(session: &Session)

Clear entire session (logout + clear all data).

pub fn is_authenticated(session: &Session, config: &SessionConfig) -> bool

Check if session is authenticated.

pub fn get_session_user( session: &Session, config: &SessionConfig, ) -> Option<User>

Get user from session.

pub fn save_request( session: &Session, url: &str, config: &SessionConfig, ) -> Result<(), SessionError>

Save the current request URL for redirect after login.

Spring Equivalent

Similar to SavedRequest in Spring Security.

pub fn get_saved_request( session: &Session, config: &SessionConfig, default_url: &str, ) -> String

Get the saved request URL and remove it from session.

Returns the saved URL or the default URL if none was saved.

pub fn config(&self) -> &SessionConfig

Get the configuration.

Trait Implementations

impl Authenticator for SessionAuthenticator

fn get_user(&self, req: &ServiceRequest) -> Option<User>

Attempts to authenticate the request and returns the user if successful.

impl Clone for SessionAuthenticator

fn clone(&self) -> SessionAuthenticator

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.