pub struct CookieSession { /* private fields */ }Expand description
Axum extractor providing mutable access to the current cookie-backed session.
CookieSession is inserted into the request extensions by
super::middleware::CookieSessionLayer. Extracting it in a handler does
not require the user to be authenticated — call CookieSession::current
to check.
All read methods are synchronous. Write methods that only modify in-memory
data (CookieSession::set, CookieSession::remove_key) are also
synchronous. Methods that touch the database (CookieSession::authenticate,
CookieSession::logout, etc.) are async.
§Panics
Panics if CookieSessionLayer is not present in the middleware stack.
Implementations§
Source§impl CookieSession
impl CookieSession
Sourcepub fn current(&self) -> Option<Session>
pub fn current(&self) -> Option<Session>
Return the loaded session for this request, if authenticated.
Sourcepub fn is_authenticated(&self) -> bool
pub fn is_authenticated(&self) -> bool
Return true when a valid, authenticated session exists for this request.
Sourcepub fn user_id(&self) -> Option<String>
pub fn user_id(&self) -> Option<String>
Return the authenticated user’s ID, or None if no session is active.
Sourcepub fn get<T: DeserializeOwned>(&self, key: &str) -> Result<Option<T>>
pub fn get<T: DeserializeOwned>(&self, key: &str) -> Result<Option<T>>
Deserialise a value stored in the session under key.
Returns Ok(None) when there is no active session or the key is absent.
§Errors
Returns an error if the stored value cannot be deserialised into T.
Sourcepub fn set<T: Serialize>(&self, key: &str, value: &T) -> Result<()>
pub fn set<T: Serialize>(&self, key: &str, value: &T) -> Result<()>
Store a serialisable value under key in the session data.
The change is held in memory and flushed to the database by the middleware after the handler returns. No-op when there is no active session.
§Errors
Returns an error if the value cannot be serialised to JSON.
Sourcepub fn remove_key(&self, key: &str)
pub fn remove_key(&self, key: &str)
Remove a key from the session data.
No-op when there is no active session or the key does not exist. The change is flushed to the database by the middleware after the handler returns.
Sourcepub async fn authenticate(&self, user_id: &str) -> Result<()>
pub async fn authenticate(&self, user_id: &str) -> Result<()>
Create a new authenticated session for user_id with empty data.
If a session already exists, it is destroyed first (session fixation prevention). A new token is generated and set on the cookie.
§Errors
Returns an error if the existing session cannot be destroyed or the new session cannot be created in the database.
Sourcepub async fn authenticate_with(&self, user_id: &str, data: Value) -> Result<()>
pub async fn authenticate_with(&self, user_id: &str, data: Value) -> Result<()>
Create a new authenticated session for user_id with initial data.
If a session already exists, it is destroyed first (session fixation prevention). A new token is generated and set on the cookie.
§Errors
Returns an error if the existing session cannot be destroyed or the new session cannot be created in the database.
Sourcepub async fn rotate(&self) -> Result<()>
pub async fn rotate(&self) -> Result<()>
Issue a new session token and refresh the session expiry.
Returns 401 Unauthorized if there is no active session. Use this
after privilege escalation to prevent session fixation.
§Errors
Returns 401 Unauthorized when no active session exists, or an
internal error if the database update fails.
Sourcepub async fn logout(&self) -> Result<()>
pub async fn logout(&self) -> Result<()>
Destroy the current session and clear the session cookie.
No-op (succeeds silently) when there is no active session.
§Errors
Returns an error if the database delete fails.
Sourcepub async fn logout_all(&self) -> Result<()>
pub async fn logout_all(&self) -> Result<()>
Destroy all sessions for the current user and clear the session cookie.
No-op (succeeds silently) when there is no active session.
§Errors
Returns an error if the database delete fails.
Sourcepub async fn logout_other(&self) -> Result<()>
pub async fn logout_other(&self) -> Result<()>
Destroy all sessions for the current user except the current one.
Returns 401 Unauthorized if there is no active session.
§Errors
Returns 401 Unauthorized when no active session exists, or an
internal error if the database delete fails.
Sourcepub async fn list_my_sessions(&self) -> Result<Vec<Session>>
pub async fn list_my_sessions(&self) -> Result<Vec<Session>>
Return all active sessions for the current user.
Returns 401 Unauthorized if there is no active session.
§Errors
Returns 401 Unauthorized when no active session exists, or an
internal error if the database query fails.
Sourcepub async fn revoke(&self, id: &str) -> Result<()>
pub async fn revoke(&self, id: &str) -> Result<()>
Revoke a specific session belonging to the current user.
Returns 401 Unauthorized if there is no active session and 404 Not Found if id does not belong to the current user (deliberately
indistinguishable to prevent enumeration).
§Errors
Returns 401 Unauthorized when no active session exists, 404 Not Found when the target session does not exist or belongs to another
user, or an internal error if the database operation fails.
Sourcepub async fn list(&self, user_id: &str) -> Result<Vec<Session>>
pub async fn list(&self, user_id: &str) -> Result<Vec<Session>>
List all active sessions for user_id.
Sourcepub async fn revoke_by_id(&self, user_id: &str, id: &str) -> Result<()>
pub async fn revoke_by_id(&self, user_id: &str, id: &str) -> Result<()>
Revoke a specific session by user and ID (no ownership check).
Sourcepub async fn revoke_all(&self, user_id: &str) -> Result<()>
pub async fn revoke_all(&self, user_id: &str) -> Result<()>
Revoke all sessions for user_id.