Struct Session 

pub struct Session { /* private fields */ }

The request’s session, available once a SessionLayer is installed.

Take it as a handler argument. It is cheap to clone and every clone refers to the same session. Changes are written when the handler returns. A request without a session cookie gets no stored session until it inserts data, logs in, rotates or asks for a CSRF token.

Requests of one session are last-writer-wins: changes made by two concurrent requests are not merged.

Implementations

impl Session

pub fn get<T: DeserializeOwned>(&self, key: &str) -> Option<T>

Read the value stored under key; None when it is absent or is not a T.

pub fn insert<T: Serialize>( &self, key: impl Into<String>, value: T, ) -> Result<(), Error>

Store value under key.

Errors

The serialization error when value is not representable as JSON.

pub fn remove(&self, key: &str) -> Option<Value>

Remove and return the value under key.

pub fn user(&self) -> Option<String>

The logged-in user, if any.

pub fn login(&self, user: impl Into<String>)

Log user in and rotate the session id.

The old id is deleted when the request ends, with no grace period, which defeats session fixation. The absolute lifetime restarts. Data stored before login is kept unless a different user was logged in. Call it only after the application has authenticated the user.

pub fn logout(&self)

Delete the session and expire the cookie.

Anything stored afterwards in the same request starts a new session.

pub fn rotate(&self)

Replace the session id, keeping the data. Use it on any privilege change and on re-authentication. The old id is deleted when the request ends.

pub fn csrf_token(&self) -> Option<String>

The CSRF token of this session: HMAC-SHA256 of the session id hash under the configured key, base64url. It changes when the id does.

Returns None when no csrf_key is configured. Asking for a token creates the session if the request had none.

pub fn verify_csrf(&self, token: &str) -> bool

Check a CSRF token from the client against this session, in constant time. false when there is no session or no key.

Trait Implementations

impl Clone for Session

fn clone(&self) -> Session

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for Session

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl FromRequestParts for Session

fn describe(op: &mut Operation, registry: &mut SchemaRegistry)

Registers the cookie scheme as an optional requirement: every request has a session, but only a logged-in one is authenticated.

async fn from_request_parts(parts: &mut Parts) -> Result<Self, ApiError>

Perform the extraction.

const BACKGROUND_TASKS: bool = false

Whether extraction needs a request-owned background queue. Custom wrappers delegating to BackgroundTasks must propagate this.