Crate siderite_sessions 

Cookie sessions and CSRF tokens for siderite applications.

This crate is an adapter: it owns cookie mechanics, id generation, rotation, expiry and CSRF tokens, and nothing about identity. Users, login flows and password storage stay in the application, which calls Session::login once it has authenticated someone. Nothing in siderite-core depends on it.

• SessionLayer loads the session named by the cookie, exposes it as the Session extractor and writes changes back.
• SessionConfig sets cookie flags (__Host- name, HttpOnly, Secure, Path=/, SameSite=Lax), lifetimes and the CSRF key.
• SessionStore is the storage trait. Stores only ever see the SHA-256 hex of a session id (id_hash). MemoryStore is included; CacheStore (feature cache) uses any siderite_cache::Cache, Redis included.

The requirements this crate implements are in docs/plans/SESSIONS_CSRF.md. For cross-site request forgery pair it with siderite_core::middleware::CsrfOrigin; add a CSRF token for forms and for SameSite=None.

use siderite_core::{App, get, post};
use siderite_sessions::{
    MemoryStore, Session, SessionConfig, SessionLayer,
};

async fn login(session: Session) -> &'static str {
    // ...authenticate the user first...
    session.login("ada");
    "welcome"
}

async fn me(session: Session) -> String {
    session.user().unwrap_or_else(|| "anonymous".into())
}

let store = MemoryStore::default();
let layer = SessionLayer::new(store, SessionConfig::new())?;
App::new()
    .route("/login", post(login))
    .route("/me", get(me))
    .layer(layer)
    .run("0.0.0.0:8000")
    .await?;

Structs

CacheStore

Sessions stored as JSON in a Cache, with the store TTL.

MemoryStore

A session store in process memory, for tests and single-process apps.

Session

The request’s session, available once a SessionLayer is installed.

SessionConfig

How sessions are issued, kept and expired.

SessionConfigError

An invalid SessionConfig, reported by SessionLayer::new.

SessionLayer

Loads the session named by the request cookie, exposes it to handlers as Session, and writes changes back when the handler returns.

SessionRecord

One stored session.

StoreError

A store failure.

Enums

SameSite

SameSite attribute for a SetCookie.

Traits

SessionStore

Server-side storage of sessions, keyed by the SHA-256 hex of the id.

Functions

id_hash

The SHA-256 of a session id as lowercase hex: the only form of an id a SessionStore ever sees.