Struct SessionLayer 

pub struct SessionLayer { /* private fields */ }

Loads the session named by the request cookie, exposes it to handlers as Session, and writes changes back when the handler returns.

What the layer guarantees:

• Idle and absolute expiry are enforced on the server from the stored record; the cookie’s own expiry is advisory.
• The idle timestamp is written at most once per write_interval, and a request that changed nothing writes nothing else.
• Fail closed: when the store cannot be read for a request that carries a session cookie (error or timeout), the request gets a 503 problem and never reaches the handler as an anonymous visitor.
• When a write that a request needed (login, rotation, a change) fails, the response becomes 503 and no cookie is set for a session that was not stored.
• Every store call is bounded by the store_timeout.
• With SameSite=None the layer also requires a valid CSRF token in a header on unsafe requests that carry a live session.

Register it with App::layer after (inside) CsrfOrigin, so forged requests are refused before any session is loaded.

Implementations

impl SessionLayer

pub fn new( store: impl SessionStore, config: SessionConfig, ) -> Result<Self, SessionConfigError>

Create the layer.

Errors

SessionConfigError when config is invalid.

Trait Implementations

impl Clone for SessionLayer

fn clone(&self) -> SessionLayer

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Layer<BoxCloneSyncService<Request<Body>, Response<Body>, Infallible>> for SessionLayer

type Service = BoxCloneSyncService<Request<Body>, Response<Body>, Infallible>

The wrapped service

fn layer(&self, inner: BoxService) -> BoxService

Wrap the given service with the middleware, returning a new service that has been decorated with the middleware.