Struct Session 

pub struct Session<'s, T: Send + Sync + Clone + 'static> { /* private fields */ }

A request guard implementing FromRequest to retrive the session based on the cookie from the user.

Implementations

impl<'s, T: Send + Sync + Clone + 'static> Session<'s, T>

pub async fn get(&self) -> SessionResult<Option<T>>

Get the session value from the store.

Returns None if there is no initialized session value or if the value has expired.

pub async fn set(&self, value: T) -> SessionResult<()>

Sets the session value from the store.

This will refresh the expiration timer.

pub async fn touch(&self) -> SessionResult<()>

Refreshes the expiration timer on the sesion in the store.

pub async fn remove(&self) -> SessionResult<()>

Removes the session from the store.

pub async fn regenerate_token<'r>(&mut self) -> SessionResult<()>

Regenerates the session token. The fairing will automatically add a cookie to the response with the new token.

It is important to regenerate the session token after a user is authenticated in order to prevent session fixation attacks.

This also has a side effect of refreshing the expiration timer on the session.

Examples

use rocket::{
	http::private::cookie::CookieBuilder,
	serde::{
		Deserialize,
		Serialize,
	},
	Build,
	Rocket,
};
use rocket_session_store::{
	memory::MemoryStore,
	Session,
	SessionError,
	SessionStore,
};

#[macro_use]
extern crate rocket;

#[launch]
fn rocket() -> Rocket<Build> {
	let session_store = SessionStore::<SessionState> {
		store: Box::new(MemoryStore::new()),
		name: "session".into(),
		duration: std::time::Duration::from_secs(24 * 60 * 60),
		cookie_builder: CookieBuilder::new("", ""),
	};

	rocket::build()
		.attach(session_store.fairing())
		.mount("/", routes![login])
}

#[post("/login")]
async fn login(mut session: Session<'_, SessionState>) -> Result<(), SessionError> {
	// Authenticate the user (check password, 2fa, etc)
	// ...

	let user_id = Some(1);

	// Important! Regenerate _before_ updating the session for the authenticated user. We don't
	// want to run into a scenario where updating the session works, but then regenerating the
	// token fails for some reason leaving the old session still valid with the user logged in
	// (eg due to an intermittent redis connection issue or something).
	session.regenerate_token().await?;
	session.set(SessionState { user_id }).await?;

	Ok(())
}

#[derive(Serialize, Deserialize, Clone, Copy)]
#[serde(crate = "rocket::serde")]
struct SessionState {
	user_id: Option<u32>,
}

Trait Implementations

impl<'r, 's, T> FromRequest<'r> for Session<'s, T>

where T: Send + Sync + 'static + Clone, 'r: 's,

type Error = ()

The associated error to be returned if derivation fails.

fn from_request<'life0, 'async_trait>( request: &'r Request<'life0>, ) -> Pin<Box<dyn Future<Output = Outcome<Self, Self::Error>> + Send + 'async_trait>>

where Self: 'async_trait, 'r: 'async_trait, 'life0: 'async_trait,

Derives an instance of Self from the incoming request metadata.