Struct trillium_sessions::SessionHandler

source ·
pub struct SessionHandler<Store> { /* private fields */ }
Expand description

§Handler to enable sessions.

See crate-level docs for an overview of this crate’s approach to sessions and security.

Implementations§

source§

impl<Store: SessionStore> SessionHandler<Store>

source

pub fn new(store: Store, secret: impl AsRef<[u8]>) -> Self

Constructs a SessionHandler from the given [async_session::SessionStore] and secret. The secret MUST be at least 32 bytes long, and MUST be cryptographically random to be secure. It is recommended to retrieve this at runtime from the environment instead of compiling it into your application.

§Panics

SessionHandler::new will panic if the secret is fewer than 32 bytes.

§Defaults

The defaults for SessionHandler are:

  • cookie path: “/”
  • cookie name: “trillium.sid”
  • session ttl: one day
  • same site: strict
  • save unchanged: enabled
  • older secrets: none
§Customization

Although the above defaults are appropriate for most applications, they can be overridden. Please be careful changing these settings, as they can weaken your application’s security:

// this logic will be unique to your deployment
let secrets_var = std::env::var("TRILLIUM_SESSION_SECRETS").unwrap();
let session_secrets = secrets_var.split(' ').collect::<Vec<_>>();

let handler = (
    CookiesHandler::new(),
    SessionHandler::new(MemoryStore::new(), session_secrets[0])
        .with_cookie_name("custom.cookie.name")
        .with_cookie_path("/some/path")
        .with_cookie_domain("trillium.rs")
        .with_same_site_policy(SameSite::Strict)
        .with_session_ttl(Some(Duration::from_secs(1)))
        .with_older_secrets(&session_secrets[1..])
        .without_save_unchanged()
);

Sets a cookie path for this session handler. The default for this value is “/”

source

pub fn with_session_ttl(self, session_ttl: Option<Duration>) -> Self

Sets a session ttl. This will be used both for the cookie expiry and also for the session-internal expiry.

The default for this value is one day. Set this to None to not set a cookie or session expiry. This is not recommended.

Sets the name of the cookie that the session is stored with or in.

If you are running multiple trillium applications on the same domain, you will need different values for each application. The default value is “trillium.sid”

source

pub fn without_save_unchanged(self) -> Self

Disables the save_unchanged setting. When save_unchanged is enabled, a session will cookie will always be set. With save_unchanged disabled, the session data must be modified from the Default value in order for it to save. If a session already exists and its data unmodified in the course of a request, the session will only be persisted if save_unchanged is enabled.

source

pub fn with_same_site_policy(self, policy: SameSite) -> Self

Sets the same site policy for the session cookie. Defaults to SameSite::Strict. See incrementally better cookies for more information about this setting

Sets the domain of the cookie.

source

pub fn with_older_secrets(self, secrets: &[impl AsRef<[u8]>]) -> Self

Sets optional older signing keys that will not be used to sign cookies, but can be used to validate previously signed cookies.

Trait Implementations§

source§

impl<Store: SessionStore> Debug for SessionHandler<Store>

source§

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter. Read more
source§

impl<Store: SessionStore> Handler for SessionHandler<Store>

source§

fn run<'life0, 'async_trait>( &'life0 self, conn: Conn, ) -> Pin<Box<dyn Future<Output = Conn> + Send + 'async_trait>>
where Self: 'async_trait, 'life0: 'async_trait,

Executes this handler, performing any modifications to the Conn that are desired.
source§

fn before_send<'life0, 'async_trait>( &'life0 self, conn: Conn, ) -> Pin<Box<dyn Future<Output = Conn> + Send + 'async_trait>>
where Self: 'async_trait, 'life0: 'async_trait,

Performs any final modifications to this conn after all handlers have been run. Although this is a slight deviation from the simple conn->conn->conn chain represented by most Handlers, it provides an easy way for libraries to effectively inject a second handler into a response chain. This is useful for loggers that need to record information both before and after other handlers have run, as well as database transaction handlers and similar library code. Read more
source§

fn init<'life0, 'life1, 'async_trait>( &'life0 mut self, _info: &'life1 mut Info, ) -> Pin<Box<dyn Future<Output = ()> + Send + 'async_trait>>
where 'life0: 'async_trait, 'life1: 'async_trait, Self: 'async_trait,

Performs one-time async set up on a mutable borrow of the Handler before the server starts accepting requests. This allows a Handler to be defined in synchronous code but perform async setup such as establishing a database connection or fetching some state from an external source. This is optional, and chances are high that you do not need this. Read more
source§

fn has_upgrade(&self, _upgrade: &Upgrade<BoxedTransport>) -> bool

predicate function answering the question of whether this Handler would like to take ownership of the negotiated Upgrade. If this returns true, you must implement Handler::upgrade. The first handler that responds true to this will receive ownership of the trillium::Upgrade in a subsequent call to Handler::upgrade
source§

fn upgrade<'life0, 'async_trait>( &'life0 self, _upgrade: Upgrade<BoxedTransport>, ) -> Pin<Box<dyn Future<Output = ()> + Send + 'async_trait>>
where 'life0: 'async_trait, Self: 'async_trait,

This will only be called if the handler reponds true to Handler::has_upgrade and will only be called once for this upgrade. There is no return value, and this function takes exclusive ownership of the underlying transport once this is called. You can downcast the transport to whatever the source transport type is and perform any non-http protocol communication that has been negotiated. You probably don’t want this unless you’re implementing something like websockets. Please note that for many transports such as TcpStreams, dropping the transport (and therefore the Upgrade) will hang up / disconnect.
source§

fn name(&self) -> Cow<'static, str>

Customize the name of your handler. This is used in Debug implementations. The default is the type name of this handler.

Auto Trait Implementations§

§

impl<Store> Freeze for SessionHandler<Store>
where Store: Freeze,

§

impl<Store> RefUnwindSafe for SessionHandler<Store>
where Store: RefUnwindSafe,

§

impl<Store> Send for SessionHandler<Store>
where Store: Send,

§

impl<Store> Sync for SessionHandler<Store>
where Store: Sync,

§

impl<Store> Unpin for SessionHandler<Store>
where Store: Unpin,

§

impl<Store> UnwindSafe for SessionHandler<Store>
where Store: UnwindSafe,

Blanket Implementations§

source§

impl<T> Any for T
where T: 'static + ?Sized,

source§

fn type_id(&self) -> TypeId

Gets the TypeId of self. Read more
source§

impl<T> Borrow<T> for T
where T: ?Sized,

source§

fn borrow(&self) -> &T

Immutably borrows from an owned value. Read more
source§

impl<T> BorrowMut<T> for T
where T: ?Sized,

source§

fn borrow_mut(&mut self) -> &mut T

Mutably borrows from an owned value. Read more
source§

impl<T> From<T> for T

source§

fn from(t: T) -> T

Returns the argument unchanged.

source§

impl<T, U> Into<U> for T
where U: From<T>,

source§

fn into(self) -> U

Calls U::from(self).

That is, this conversion is whatever the implementation of From<T> for U chooses to do.

source§

impl<T> Same for T

§

type Output = T

Should always be Self
source§

impl<T, U> TryFrom<U> for T
where U: Into<T>,

§

type Error = Infallible

The type returned in the event of a conversion error.
source§

fn try_from(value: U) -> Result<T, <T as TryFrom<U>>::Error>

Performs the conversion.
source§

impl<T, U> TryInto<U> for T
where U: TryFrom<T>,

§

type Error = <U as TryFrom<T>>::Error

The type returned in the event of a conversion error.
source§

fn try_into(self) -> Result<U, <U as TryFrom<T>>::Error>

Performs the conversion.
§

impl<V, T> VZip<V> for T
where V: MultiLane<T>,

§

fn vzip(self) -> V