2013-04-05 15:50:53 +00:00
|
|
|
package session
|
|
|
|
|
|
|
|
import (
|
2013-09-26 10:07:00 +00:00
|
|
|
"crypto/hmac"
|
|
|
|
"crypto/md5"
|
2013-04-05 15:50:53 +00:00
|
|
|
"crypto/rand"
|
2013-09-26 10:07:00 +00:00
|
|
|
"crypto/sha1"
|
|
|
|
"encoding/hex"
|
2014-01-05 06:48:36 +00:00
|
|
|
"encoding/json"
|
2013-04-05 15:50:53 +00:00
|
|
|
"fmt"
|
|
|
|
"io"
|
|
|
|
"net/http"
|
|
|
|
"net/url"
|
|
|
|
"time"
|
|
|
|
)
|
|
|
|
|
2014-01-28 17:05:56 +00:00
|
|
|
// SessionStore contains all data for one session process with specific id.
|
2013-04-05 15:50:53 +00:00
|
|
|
type SessionStore interface {
|
2014-01-05 06:48:36 +00:00
|
|
|
Set(key, value interface{}) error //set session value
|
|
|
|
Get(key interface{}) interface{} //get session value
|
|
|
|
Delete(key interface{}) error //delete session value
|
|
|
|
SessionID() string //back current sessionID
|
|
|
|
SessionRelease(w http.ResponseWriter) // release the resource & save data to provider & return the data
|
|
|
|
Flush() error //delete all data
|
2013-04-05 15:50:53 +00:00
|
|
|
}
|
|
|
|
|
2014-01-28 17:05:56 +00:00
|
|
|
// Provider contains global session methods and saved SessionStores.
|
|
|
|
// it can operate a SessionStore by its id.
|
2013-04-05 15:50:53 +00:00
|
|
|
type Provider interface {
|
2014-01-05 06:48:36 +00:00
|
|
|
SessionInit(gclifetime int64, config string) error
|
2013-04-05 15:50:53 +00:00
|
|
|
SessionRead(sid string) (SessionStore, error)
|
2013-11-05 14:23:48 +00:00
|
|
|
SessionExist(sid string) bool
|
2013-09-26 10:07:00 +00:00
|
|
|
SessionRegenerate(oldsid, sid string) (SessionStore, error)
|
2013-04-05 15:50:53 +00:00
|
|
|
SessionDestroy(sid string) error
|
2013-11-01 16:16:10 +00:00
|
|
|
SessionAll() int //get all active session
|
2013-04-05 15:50:53 +00:00
|
|
|
SessionGC()
|
|
|
|
}
|
|
|
|
|
|
|
|
var provides = make(map[string]Provider)
|
|
|
|
|
|
|
|
// Register makes a session provide available by the provided name.
|
|
|
|
// If Register is called twice with the same name or if driver is nil,
|
|
|
|
// it panics.
|
|
|
|
func Register(name string, provide Provider) {
|
|
|
|
if provide == nil {
|
|
|
|
panic("session: Register provide is nil")
|
|
|
|
}
|
|
|
|
if _, dup := provides[name]; dup {
|
|
|
|
panic("session: Register called twice for provider " + name)
|
|
|
|
}
|
|
|
|
provides[name] = provide
|
|
|
|
}
|
|
|
|
|
2014-01-05 06:48:36 +00:00
|
|
|
type managerConfig struct {
|
|
|
|
CookieName string `json:"cookieName"`
|
|
|
|
EnableSetCookie bool `json:"enableSetCookie,omitempty"`
|
|
|
|
Gclifetime int64 `json:"gclifetime"`
|
2014-01-08 12:54:20 +00:00
|
|
|
Maxlifetime int64 `json:"maxLifetime"`
|
2014-01-05 06:48:36 +00:00
|
|
|
Secure bool `json:"secure"`
|
|
|
|
SessionIDHashFunc string `json:"sessionIDHashFunc"`
|
|
|
|
SessionIDHashKey string `json:"sessionIDHashKey"`
|
2014-02-21 17:04:47 +00:00
|
|
|
CookieLifeTime int `json:"cookieLifeTime"`
|
2014-01-05 06:48:36 +00:00
|
|
|
ProviderConfig string `json:"providerConfig"`
|
|
|
|
}
|
|
|
|
|
2014-01-28 17:05:56 +00:00
|
|
|
// Manager contains Provider and its configuration.
|
2013-04-05 15:50:53 +00:00
|
|
|
type Manager struct {
|
2014-01-05 06:48:36 +00:00
|
|
|
provider Provider
|
|
|
|
config *managerConfig
|
2013-04-05 15:50:53 +00:00
|
|
|
}
|
|
|
|
|
2014-01-28 17:05:56 +00:00
|
|
|
// Create new Manager with provider name and json config string.
|
|
|
|
// provider name:
|
|
|
|
// 1. cookie
|
|
|
|
// 2. file
|
|
|
|
// 3. memory
|
|
|
|
// 4. redis
|
|
|
|
// 5. mysql
|
|
|
|
// json config:
|
|
|
|
// 1. is https default false
|
|
|
|
// 2. hashfunc default sha1
|
|
|
|
// 3. hashkey default beegosessionkey
|
|
|
|
// 4. maxage default is none
|
2014-01-05 06:48:36 +00:00
|
|
|
func NewManager(provideName, config string) (*Manager, error) {
|
2013-04-05 15:50:53 +00:00
|
|
|
provider, ok := provides[provideName]
|
|
|
|
if !ok {
|
|
|
|
return nil, fmt.Errorf("session: unknown provide %q (forgotten import?)", provideName)
|
|
|
|
}
|
2014-01-05 06:48:36 +00:00
|
|
|
cf := new(managerConfig)
|
|
|
|
cf.EnableSetCookie = true
|
|
|
|
err := json.Unmarshal([]byte(config), cf)
|
|
|
|
if err != nil {
|
|
|
|
return nil, err
|
2013-10-28 13:44:07 +00:00
|
|
|
}
|
2014-01-08 12:54:20 +00:00
|
|
|
if cf.Maxlifetime == 0 {
|
|
|
|
cf.Maxlifetime = cf.Gclifetime
|
|
|
|
}
|
2014-01-08 15:24:31 +00:00
|
|
|
err = provider.SessionInit(cf.Maxlifetime, cf.ProviderConfig)
|
|
|
|
if err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
2014-01-05 06:48:36 +00:00
|
|
|
if cf.SessionIDHashFunc == "" {
|
|
|
|
cf.SessionIDHashFunc = "sha1"
|
2013-09-26 10:07:00 +00:00
|
|
|
}
|
2014-01-05 06:48:36 +00:00
|
|
|
if cf.SessionIDHashKey == "" {
|
|
|
|
cf.SessionIDHashKey = string(generateRandomKey(16))
|
2013-10-28 13:44:07 +00:00
|
|
|
}
|
2014-01-05 06:48:36 +00:00
|
|
|
|
2013-09-26 10:07:00 +00:00
|
|
|
return &Manager{
|
2014-01-05 06:48:36 +00:00
|
|
|
provider,
|
|
|
|
cf,
|
2013-09-26 10:07:00 +00:00
|
|
|
}, nil
|
2013-04-05 15:50:53 +00:00
|
|
|
}
|
|
|
|
|
2014-01-28 17:05:56 +00:00
|
|
|
// Start session. generate or read the session id from http request.
|
|
|
|
// if session id exists, return SessionStore with this id.
|
2013-04-05 15:50:53 +00:00
|
|
|
func (manager *Manager) SessionStart(w http.ResponseWriter, r *http.Request) (session SessionStore) {
|
2014-01-05 06:48:36 +00:00
|
|
|
cookie, err := r.Cookie(manager.config.CookieName)
|
2013-04-05 15:50:53 +00:00
|
|
|
if err != nil || cookie.Value == "" {
|
2013-09-26 10:07:00 +00:00
|
|
|
sid := manager.sessionId(r)
|
2013-04-05 15:50:53 +00:00
|
|
|
session, _ = manager.provider.SessionRead(sid)
|
2014-01-05 06:48:36 +00:00
|
|
|
cookie = &http.Cookie{Name: manager.config.CookieName,
|
2013-04-08 04:50:11 +00:00
|
|
|
Value: url.QueryEscape(sid),
|
|
|
|
Path: "/",
|
|
|
|
HttpOnly: true,
|
2014-01-05 06:48:36 +00:00
|
|
|
Secure: manager.config.Secure}
|
2014-02-21 17:04:47 +00:00
|
|
|
if manager.config.CookieLifeTime >= 0 {
|
|
|
|
cookie.MaxAge = manager.config.CookieLifeTime
|
2014-01-05 06:48:36 +00:00
|
|
|
}
|
|
|
|
if manager.config.EnableSetCookie {
|
|
|
|
http.SetCookie(w, cookie)
|
2013-09-26 10:07:00 +00:00
|
|
|
}
|
|
|
|
r.AddCookie(cookie)
|
2013-04-05 15:50:53 +00:00
|
|
|
} else {
|
|
|
|
sid, _ := url.QueryUnescape(cookie.Value)
|
2013-11-05 14:23:48 +00:00
|
|
|
if manager.provider.SessionExist(sid) {
|
|
|
|
session, _ = manager.provider.SessionRead(sid)
|
|
|
|
} else {
|
|
|
|
sid = manager.sessionId(r)
|
|
|
|
session, _ = manager.provider.SessionRead(sid)
|
2014-01-05 06:48:36 +00:00
|
|
|
cookie = &http.Cookie{Name: manager.config.CookieName,
|
2013-11-05 14:23:48 +00:00
|
|
|
Value: url.QueryEscape(sid),
|
|
|
|
Path: "/",
|
|
|
|
HttpOnly: true,
|
2014-01-05 06:48:36 +00:00
|
|
|
Secure: manager.config.Secure}
|
2014-02-21 17:04:47 +00:00
|
|
|
if manager.config.CookieLifeTime >= 0 {
|
|
|
|
cookie.MaxAge = manager.config.CookieLifeTime
|
2014-01-05 06:48:36 +00:00
|
|
|
}
|
|
|
|
if manager.config.EnableSetCookie {
|
|
|
|
http.SetCookie(w, cookie)
|
2013-11-05 14:23:48 +00:00
|
|
|
}
|
|
|
|
r.AddCookie(cookie)
|
|
|
|
}
|
2013-04-05 15:50:53 +00:00
|
|
|
}
|
|
|
|
return
|
|
|
|
}
|
|
|
|
|
2014-01-28 17:05:56 +00:00
|
|
|
// Destroy session by its id in http request cookie.
|
2013-04-05 15:50:53 +00:00
|
|
|
func (manager *Manager) SessionDestroy(w http.ResponseWriter, r *http.Request) {
|
2014-01-05 06:48:36 +00:00
|
|
|
cookie, err := r.Cookie(manager.config.CookieName)
|
2013-04-05 15:50:53 +00:00
|
|
|
if err != nil || cookie.Value == "" {
|
|
|
|
return
|
|
|
|
} else {
|
|
|
|
manager.provider.SessionDestroy(cookie.Value)
|
|
|
|
expiration := time.Now()
|
2014-01-05 06:48:36 +00:00
|
|
|
cookie := http.Cookie{Name: manager.config.CookieName,
|
|
|
|
Path: "/",
|
|
|
|
HttpOnly: true,
|
|
|
|
Expires: expiration,
|
|
|
|
MaxAge: -1}
|
2013-04-05 15:50:53 +00:00
|
|
|
http.SetCookie(w, &cookie)
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2014-01-28 17:05:56 +00:00
|
|
|
// Get SessionStore by its id.
|
2014-03-21 06:24:00 +00:00
|
|
|
func (manager *Manager) GetSessionStore(sid string) (sessions SessionStore, err error) {
|
2013-10-28 15:25:30 +00:00
|
|
|
sessions, err = manager.provider.SessionRead(sid)
|
|
|
|
return
|
|
|
|
}
|
|
|
|
|
2014-01-28 17:05:56 +00:00
|
|
|
// Start session gc process.
|
|
|
|
// it can do gc in times after gc lifetime.
|
2013-04-05 15:50:53 +00:00
|
|
|
func (manager *Manager) GC() {
|
|
|
|
manager.provider.SessionGC()
|
2014-01-05 06:48:36 +00:00
|
|
|
time.AfterFunc(time.Duration(manager.config.Gclifetime)*time.Second, func() { manager.GC() })
|
2013-04-05 15:50:53 +00:00
|
|
|
}
|
|
|
|
|
2014-01-28 17:05:56 +00:00
|
|
|
// Regenerate a session id for this SessionStore who's id is saving in http request.
|
2013-09-26 10:07:00 +00:00
|
|
|
func (manager *Manager) SessionRegenerateId(w http.ResponseWriter, r *http.Request) (session SessionStore) {
|
|
|
|
sid := manager.sessionId(r)
|
2014-01-05 06:48:36 +00:00
|
|
|
cookie, err := r.Cookie(manager.config.CookieName)
|
2013-09-26 10:07:00 +00:00
|
|
|
if err != nil && cookie.Value == "" {
|
|
|
|
//delete old cookie
|
|
|
|
session, _ = manager.provider.SessionRead(sid)
|
2014-01-05 06:48:36 +00:00
|
|
|
cookie = &http.Cookie{Name: manager.config.CookieName,
|
2013-09-26 10:07:00 +00:00
|
|
|
Value: url.QueryEscape(sid),
|
|
|
|
Path: "/",
|
|
|
|
HttpOnly: true,
|
2014-01-05 06:48:36 +00:00
|
|
|
Secure: manager.config.Secure,
|
2013-09-26 10:07:00 +00:00
|
|
|
}
|
|
|
|
} else {
|
|
|
|
oldsid, _ := url.QueryUnescape(cookie.Value)
|
|
|
|
session, _ = manager.provider.SessionRegenerate(oldsid, sid)
|
|
|
|
cookie.Value = url.QueryEscape(sid)
|
|
|
|
cookie.HttpOnly = true
|
|
|
|
cookie.Path = "/"
|
|
|
|
}
|
2014-02-21 17:04:47 +00:00
|
|
|
if manager.config.CookieLifeTime >= 0 {
|
|
|
|
cookie.MaxAge = manager.config.CookieLifeTime
|
2013-09-26 10:07:00 +00:00
|
|
|
}
|
|
|
|
http.SetCookie(w, cookie)
|
|
|
|
r.AddCookie(cookie)
|
|
|
|
return
|
|
|
|
}
|
|
|
|
|
2014-01-28 17:05:56 +00:00
|
|
|
// Get all active sessions count number.
|
2013-11-01 16:16:10 +00:00
|
|
|
func (manager *Manager) GetActiveSession() int {
|
|
|
|
return manager.provider.SessionAll()
|
|
|
|
}
|
|
|
|
|
2014-01-28 17:05:56 +00:00
|
|
|
// Set hash function for generating session id.
|
2013-11-05 13:59:35 +00:00
|
|
|
func (manager *Manager) SetHashFunc(hasfunc, hashkey string) {
|
2014-01-05 06:48:36 +00:00
|
|
|
manager.config.SessionIDHashFunc = hasfunc
|
|
|
|
manager.config.SessionIDHashKey = hashkey
|
2013-11-05 13:59:35 +00:00
|
|
|
}
|
2013-09-26 10:07:00 +00:00
|
|
|
|
2014-01-28 17:05:56 +00:00
|
|
|
// Set cookie with https.
|
2013-11-05 13:59:35 +00:00
|
|
|
func (manager *Manager) SetSecure(secure bool) {
|
2014-01-05 06:48:36 +00:00
|
|
|
manager.config.Secure = secure
|
2013-11-05 13:59:35 +00:00
|
|
|
}
|
|
|
|
|
2014-01-28 17:05:56 +00:00
|
|
|
// generate session id with rand string, unix nano time, remote addr by hash function.
|
2013-09-26 10:07:00 +00:00
|
|
|
func (manager *Manager) sessionId(r *http.Request) (sid string) {
|
2013-10-21 14:06:30 +00:00
|
|
|
bs := make([]byte, 24)
|
|
|
|
if _, err := io.ReadFull(rand.Reader, bs); err != nil {
|
2013-04-05 15:50:53 +00:00
|
|
|
return ""
|
|
|
|
}
|
2013-09-26 10:07:00 +00:00
|
|
|
sig := fmt.Sprintf("%s%d%s", r.RemoteAddr, time.Now().UnixNano(), bs)
|
2014-01-05 06:48:36 +00:00
|
|
|
if manager.config.SessionIDHashFunc == "md5" {
|
2013-09-26 10:07:00 +00:00
|
|
|
h := md5.New()
|
2013-10-21 14:06:30 +00:00
|
|
|
h.Write([]byte(sig))
|
|
|
|
sid = hex.EncodeToString(h.Sum(nil))
|
2014-01-05 06:48:36 +00:00
|
|
|
} else if manager.config.SessionIDHashFunc == "sha1" {
|
|
|
|
h := hmac.New(sha1.New, []byte(manager.config.SessionIDHashKey))
|
2013-09-26 10:07:00 +00:00
|
|
|
fmt.Fprintf(h, "%s", sig)
|
2013-10-21 14:06:30 +00:00
|
|
|
sid = hex.EncodeToString(h.Sum(nil))
|
2013-09-26 10:07:00 +00:00
|
|
|
} else {
|
2014-01-05 06:48:36 +00:00
|
|
|
h := hmac.New(sha1.New, []byte(manager.config.SessionIDHashKey))
|
2013-09-26 10:07:00 +00:00
|
|
|
fmt.Fprintf(h, "%s", sig)
|
2013-10-21 14:06:30 +00:00
|
|
|
sid = hex.EncodeToString(h.Sum(nil))
|
2013-09-26 10:07:00 +00:00
|
|
|
}
|
|
|
|
return
|
2013-04-05 15:50:53 +00:00
|
|
|
}
|