Struct CookieSessionStore 

pub struct CookieSessionStore { /* private fields */ }

The default, stateless session store: the whole session is serialized into a cookie value and signed with HMAC-SHA256 so it cannot be tampered with. The cookie value is base64url(payload).base64url(signature).

(Spec 07 also calls for AES-256-GCM encryption on top of the signature; that is a follow-up — this signs but does not yet encrypt the payload.)

Implementations

impl CookieSessionStore

pub fn new(secret: impl Into<Vec<u8>>) -> Self

Build a store that signs cookies with secret (e.g. secret_key_base).

pub fn encode(&self, session: &Session) -> String

Serialize and sign session into a payload.signature cookie value.

pub fn decode(&self, raw: &str) -> Option<Session>

Verify and parse a signed cookie value. Returns None when the value is malformed, or the signature does not match (tampering or a wrong secret).

Trait Implementations

impl Default for CookieSessionStore

fn default() -> Self

A dev-only store with a fixed, insecure secret. Real apps must call CookieSessionStore::new with a secret from config/credentials.

impl SessionStore for CookieSessionStore

fn load<'life0, 'life1, 'async_trait>( &'life0 self, raw: &'life1 str, ) -> Pin<Box<dyn Future<Output = Result<Option<Session>>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait,

Decode a signed cookie value (the “id” argument carries the raw cookie).

fn save<'life0, 'life1, 'async_trait>( &'life0 self, _session: &'life1 Session, ) -> Pin<Box<dyn Future<Output = Result<()>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait,

No-op: a cookie session persists by having the response set its cookie (via CookieSessionStore::encode); there is no server-side state.

fn destroy<'life0, 'life1, 'async_trait>( &'life0 self, _id: &'life1 str, ) -> Pin<Box<dyn Future<Output = Result<()>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait,