Skip to main content

SessionStore

rainier_auth

Trait SessionStore 

Source 
pub trait SessionStore:
    Send
    + Sync
    + 'static {
    // Required methods
    fn name(&self) -> &str;
    fn read<'a>(
        &'a self,
        id: &'a str,
    ) -> Pin<Box<dyn Future<Output = Result<Option<SessionData>, Error>> + Send + 'a>>;
    fn write<'a>(
        &'a self,
        id: &'a str,
        data: &'a SessionData,
    ) -> Pin<Box<dyn Future<Output = Result<(), Error>> + Send + 'a>>;
    fn destroy<'a>(
        &'a self,
        id: &'a str,
    ) -> Pin<Box<dyn Future<Output = Result<(), Error>> + Send + 'a>>;

    // Provided methods
    fn gc(
        &self,
    ) -> Pin<Box<dyn Future<Output = Result<u64, Error>> + Send + '_>> { ... }
    fn is_client_side(&self) -> bool { ... }
    fn encode(&self, id: &str, data: &SessionData) -> Result<String, Error> { ... }
    fn decode(
        &self,
        value: &str,
    ) -> Result<(String, Option<SessionData>), Error> { ... }
}
Expand description

Where session data is kept between requests.

The four required methods are the server-side shape: an id in the cookie, the data somewhere else. encode and decode exist so a store can instead put the whole session in the cookie — see CookieSessionStore — without the middleware needing to know which kind it has.

Required Methods§

Source

fn name(&self) -> &str

A label for diagnostics — "memory", "database", "cache", "cookie".

Source

fn read<'a>( &'a self, id: &'a str, ) -> Pin<Box<dyn Future<Output = Result<Option<SessionData>, Error>> + Send + 'a>>

The data for this id, or None if it is unknown or expired.

Source

fn write<'a>( &'a self, id: &'a str, data: &'a SessionData, ) -> Pin<Box<dyn Future<Output = Result<(), Error>> + Send + 'a>>

Write the data back, refreshing its expiry.

Source

fn destroy<'a>( &'a self, id: &'a str, ) -> Pin<Box<dyn Future<Output = Result<(), Error>> + Send + 'a>>

Remove a session.

Provided Methods§

Source

fn gc(&self) -> Pin<Box<dyn Future<Output = Result<u64, Error>> + Send + '_>>

Discard every expired session. Called periodically, not per request.

Source

fn is_client_side(&self) -> bool

Whether the session travels in the cookie rather than being stored here.

A client-side store’s read and write are never called by the middleware.

Source

fn encode(&self, id: &str, data: &SessionData) -> Result<String, Error>

The cookie value carrying this session.

Server-side stores return the id, which is the default.

Source

fn decode(&self, value: &str) -> Result<(String, Option<SessionData>), Error>

Recover a session id — and, for a client-side store, its data — from a cookie value.

The default rejects anything that is not the shape generate_session_id produces. A cookie is client-supplied, so an id we did not mint is not worth a round trip, and letting a client choose its own id is how session fixation starts.

Dyn Compatibility§

This trait is dyn compatible.

In older versions of Rust, dyn compatibility was called "object safety".

Implementors§