tide sessions #646
tide sessions #646
Conversation
|
We should probably also provide a |
|
update: https://github.com/jbr/async-redis-session (not published yet) |
examples/sessions.rs
Outdated
| tide::log::start(); | ||
| let mut app = tide::new(); | ||
|
|
||
| app.middleware(tide::sessions::SessionMiddleware::memory_store( |
There was a problem hiding this comment.
Imo show with cookie store instead.
There was a problem hiding this comment.
i don't think there's anything wrong with starting people out on the memory store, since its flaws are more obvious (losing data on server restart). we want to strongly encourage people not to use either of them, and i think the sled store will probably be the recommended choice for apps that don't already have an external db
src/sessions/middleware.rs
Outdated
| /// set on the outbound response and signed with an HKDF key derived | ||
| /// from the `secret` provided on creation of the SessionMiddleware. | ||
| /// The configurable session store uses a SHA256 digest of the cookie | ||
| /// value and stores the session along with a potential expiry. |
There was a problem hiding this comment.
| /// value and stores the session along with a potential expiry. | |
| /// value as an id and stores the session along with a potential expiry. |
jbr
force-pushed
the
sessions
branch
4 times, most recently
from
a4bb48d to
f1cbfa8
Compare
|
@Fishrock123 Have your concerns been addressed? This is otherwise ready to merge, but you still have a change request on this |
jbr
force-pushed
the
sessions
branch
3 times, most recently
from
7b0a320 to
2090f07
Compare
this is an initial implementation of a session middleware in tide, using a somewhat modified async-sessions crate. this is implemented as a
sessionsfeature, which is enabled by default.this pr reuses some of the signed cookie behavior from the cookie crate without requiring the entire application use signed cookies. this is to ensure that all users of sessions have signed cookies regardless of the rest of their application settings.
closes: #9
blocked on:
http-rs/async-session#2Publishing async-session 2.0.0 (@yoshuawuyts)@Fishrock123 clarifying change requestrelated: #541
as part of exploring this approach, I've fully implemented these session stores: