Crate churust_redis 

Redis-backed sessions for the Churust web framework.

RedisStore implements SessionStore, so it drops into Sessions::with_store:

use churust_core::{Churust, Sessions};
use churust_redis::RedisStore;

let store = RedisStore::connect("redis://127.0.0.1/").await?;
let app = Churust::server()
    .install(Sessions::with_store(store.ttl(3600)))
    .build();

What this buys over the cookie store

Revocation, and room. CookieStore keeps the whole session in the visitor’s cookie: it travels on every request, it is readable by whoever holds it, and a copy taken before logout stays valid until its signed deadline because nothing server-side records that it was withdrawn. Here the cookie carries only an opaque identifier, the contents live in Redis, and logging out deletes the record, so a stolen cookie stops working the moment its owner signs out.

That promise is only worth having if a broken one is audible, so a delete that does not reach Redis fails the request instead of returning a farewell page over a session that is still alive.

The cost is an ordinary one: a network round trip per request that touches the session, and a Redis to keep running.

Session identifiers

256 bits from the operating system’s CSPRNG, base64url encoded. A session id is a bearer credential for the whole account, so it is generated the same way a token would be, and identifiers that do not match that shape are refused on load without a round trip rather than passed through into a key.

Structs

RedisStore

A SessionStore that keeps session contents in Redis.