Module session 

Cookie-based server-side sessions

The browser only holds an unguessable session id (256 bits from the OS CSPRNG) in an HttpOnly, SameSite=Lax cookie; the data lives in a SessionStore. Anonymous visitors that never write to the session get no cookie at all.

use ullun::prelude::*;
use ullun::session::SessionLayer;

App::new()
    .middleware(SessionLayer::new())
    .post("/login", |req: Request| async move {
        let session = req.session()?;
        session.renew();                               // new id on privilege change: no fixation
        session.set("user", "ann")?;
        Ok(Response::redirect("/"))
    })
    .get("/", |req: Request| async move {
        let user: Option<String> = req.session()?.get("user");
        Ok(Response::text(format!("hello {}", user.unwrap_or_else(|| "stranger".into()))))
    })
    .run("127.0.0.1:3000")
    .await
    .unwrap();

Defaults: cookie __Host-sid (needs HTTPS: Secure, Path=/, no Domain), 30 minutes idle and 12 hours absolute lifetime. For plain-HTTP development use SessionLayer::insecure_cookies. Concurrent requests of one session are not merged: the last response to finish wins, so keep session data small and put mutable state in your database.

Structs

MemoryStore

In-process store with a size cap; sessions are lost on restart and not shared between instances

Session

The session of the current request; cheap to clone

SessionLayer

Session middleware

SessionRecord

What a store keeps per session

Traits

SessionStore

Where session data lives. Implement it for Redis, a database, …