class

Session::Store(T)

Inherits Reference < Object

Abstract base class for session storage backends

Generic Constraint: T must inherit from Session::Base T must provide a parameterless constructor (T.new)

Example usage:

class UserSession < Session::Base
property? authenticated : Bool = false
property user_id : Int64? = nil
end

# Use memory store for development
store = Session::MemoryStore(UserSession).new

# Use Redis for production
store = Session::RedisStore(UserSession).new(Redis.new)

Instance methods

[](key : String) : T

Core store operations

Source

[]=(key : String, session : T) : T

Source

[]?(key : String) : T | Nil

Source

authenticate

Change the session's privileges (log in, switch user, elevate) and give it a new id in one step. Re-using the id a visitor had before logging in lets anyone who planted or observed it (session fixation) share the authenticated session.

store.authenticate { |session| session.user_id = user.id }

Source

clear

Source

create

Source

current_session

The session of the request being served. A store is shared by every request, so it is kept per fiber: concurrent requests, and the next request on a keep-alive connection, never see each other's session. SessionHandler calls release when a request ends.

A fiber spawned during a request starts with a blank session; capture the session before spawn to use it there.

Source

current_session=(current_session : T)

Source

current_session?

The current fiber's session, or nil when no request is being served on it.

Source

delete(key : String)

Source

delete

Delete current session and create a new one

Source

encrypts_with_secret?

Whether this store encrypts sessions with Session.config.secret. Session.configure and SessionHandler require a usable secret only when it does. The default follows encrypt_redis_data (RedisStore, ClusteredRedisStore); a store that never encrypts returns false (MemoryStore), and one that always does returns true (CookieStore).

Source

flash

The current request's flash messages (those of its session).

Source

load_from(request_cookies : HTTP::Cookies) : T | Nil

Source

on(event : Symbol, session_id : String, session : T)

Source

regenerate_id

Regenerate session ID while preserving session data Important for security after authentication state changes

Source

release