1
0
mirror of https://github.com/astaxie/beego.git synced 2024-10-31 23:40:55 +00:00
Beego/session/session.go

254 lines
7.4 KiB
Go
Raw Normal View History

package session
import (
2013-09-26 10:07:00 +00:00
"crypto/hmac"
"crypto/md5"
"crypto/rand"
2013-09-26 10:07:00 +00:00
"crypto/sha1"
"encoding/hex"
2014-01-05 06:48:36 +00:00
"encoding/json"
"fmt"
"io"
"net/http"
"net/url"
"time"
)
// SessionStore contains all data for one session process with specific id.
type SessionStore interface {
2014-01-05 06:48:36 +00:00
Set(key, value interface{}) error //set session value
Get(key interface{}) interface{} //get session value
Delete(key interface{}) error //delete session value
SessionID() string //back current sessionID
SessionRelease(w http.ResponseWriter) // release the resource & save data to provider & return the data
Flush() error //delete all data
}
// Provider contains global session methods and saved SessionStores.
// it can operate a SessionStore by its id.
type Provider interface {
2014-01-05 06:48:36 +00:00
SessionInit(gclifetime int64, config string) error
SessionRead(sid string) (SessionStore, error)
2013-11-05 14:23:48 +00:00
SessionExist(sid string) bool
2013-09-26 10:07:00 +00:00
SessionRegenerate(oldsid, sid string) (SessionStore, error)
SessionDestroy(sid string) error
2013-11-01 16:16:10 +00:00
SessionAll() int //get all active session
SessionGC()
}
var provides = make(map[string]Provider)
// Register makes a session provide available by the provided name.
// If Register is called twice with the same name or if driver is nil,
// it panics.
func Register(name string, provide Provider) {
if provide == nil {
panic("session: Register provide is nil")
}
if _, dup := provides[name]; dup {
panic("session: Register called twice for provider " + name)
}
provides[name] = provide
}
2014-01-05 06:48:36 +00:00
type managerConfig struct {
CookieName string `json:"cookieName"`
EnableSetCookie bool `json:"enableSetCookie,omitempty"`
Gclifetime int64 `json:"gclifetime"`
Maxlifetime int64 `json:"maxLifetime"`
2014-01-05 06:48:36 +00:00
Secure bool `json:"secure"`
SessionIDHashFunc string `json:"sessionIDHashFunc"`
SessionIDHashKey string `json:"sessionIDHashKey"`
2014-02-21 17:04:47 +00:00
CookieLifeTime int `json:"cookieLifeTime"`
2014-01-05 06:48:36 +00:00
ProviderConfig string `json:"providerConfig"`
}
// Manager contains Provider and its configuration.
type Manager struct {
2014-01-05 06:48:36 +00:00
provider Provider
config *managerConfig
}
// Create new Manager with provider name and json config string.
// provider name:
// 1. cookie
// 2. file
// 3. memory
// 4. redis
// 5. mysql
// json config:
// 1. is https default false
// 2. hashfunc default sha1
// 3. hashkey default beegosessionkey
// 4. maxage default is none
2014-01-05 06:48:36 +00:00
func NewManager(provideName, config string) (*Manager, error) {
provider, ok := provides[provideName]
if !ok {
return nil, fmt.Errorf("session: unknown provide %q (forgotten import?)", provideName)
}
2014-01-05 06:48:36 +00:00
cf := new(managerConfig)
cf.EnableSetCookie = true
err := json.Unmarshal([]byte(config), cf)
if err != nil {
return nil, err
2013-10-28 13:44:07 +00:00
}
if cf.Maxlifetime == 0 {
cf.Maxlifetime = cf.Gclifetime
}
2014-01-08 15:24:31 +00:00
err = provider.SessionInit(cf.Maxlifetime, cf.ProviderConfig)
if err != nil {
return nil, err
}
2014-01-05 06:48:36 +00:00
if cf.SessionIDHashFunc == "" {
cf.SessionIDHashFunc = "sha1"
2013-09-26 10:07:00 +00:00
}
2014-01-05 06:48:36 +00:00
if cf.SessionIDHashKey == "" {
cf.SessionIDHashKey = string(generateRandomKey(16))
2013-10-28 13:44:07 +00:00
}
2014-01-05 06:48:36 +00:00
2013-09-26 10:07:00 +00:00
return &Manager{
2014-01-05 06:48:36 +00:00
provider,
cf,
2013-09-26 10:07:00 +00:00
}, nil
}
// Start session. generate or read the session id from http request.
// if session id exists, return SessionStore with this id.
func (manager *Manager) SessionStart(w http.ResponseWriter, r *http.Request) (session SessionStore) {
2014-01-05 06:48:36 +00:00
cookie, err := r.Cookie(manager.config.CookieName)
if err != nil || cookie.Value == "" {
2013-09-26 10:07:00 +00:00
sid := manager.sessionId(r)
session, _ = manager.provider.SessionRead(sid)
2014-01-05 06:48:36 +00:00
cookie = &http.Cookie{Name: manager.config.CookieName,
2013-04-08 04:50:11 +00:00
Value: url.QueryEscape(sid),
Path: "/",
HttpOnly: true,
2014-01-05 06:48:36 +00:00
Secure: manager.config.Secure}
2014-02-21 17:04:47 +00:00
if manager.config.CookieLifeTime >= 0 {
cookie.MaxAge = manager.config.CookieLifeTime
2014-01-05 06:48:36 +00:00
}
if manager.config.EnableSetCookie {
http.SetCookie(w, cookie)
2013-09-26 10:07:00 +00:00
}
r.AddCookie(cookie)
} else {
sid, _ := url.QueryUnescape(cookie.Value)
2013-11-05 14:23:48 +00:00
if manager.provider.SessionExist(sid) {
session, _ = manager.provider.SessionRead(sid)
} else {
sid = manager.sessionId(r)
session, _ = manager.provider.SessionRead(sid)
2014-01-05 06:48:36 +00:00
cookie = &http.Cookie{Name: manager.config.CookieName,
2013-11-05 14:23:48 +00:00
Value: url.QueryEscape(sid),
Path: "/",
HttpOnly: true,
2014-01-05 06:48:36 +00:00
Secure: manager.config.Secure}
2014-02-21 17:04:47 +00:00
if manager.config.CookieLifeTime >= 0 {
cookie.MaxAge = manager.config.CookieLifeTime
2014-01-05 06:48:36 +00:00
}
if manager.config.EnableSetCookie {
http.SetCookie(w, cookie)
2013-11-05 14:23:48 +00:00
}
r.AddCookie(cookie)
}
}
return
}
// Destroy session by its id in http request cookie.
func (manager *Manager) SessionDestroy(w http.ResponseWriter, r *http.Request) {
2014-01-05 06:48:36 +00:00
cookie, err := r.Cookie(manager.config.CookieName)
if err != nil || cookie.Value == "" {
return
} else {
manager.provider.SessionDestroy(cookie.Value)
expiration := time.Now()
2014-01-05 06:48:36 +00:00
cookie := http.Cookie{Name: manager.config.CookieName,
Path: "/",
HttpOnly: true,
Expires: expiration,
MaxAge: -1}
http.SetCookie(w, &cookie)
}
}
// Get SessionStore by its id.
2014-03-21 06:24:00 +00:00
func (manager *Manager) GetSessionStore(sid string) (sessions SessionStore, err error) {
2013-10-28 15:25:30 +00:00
sessions, err = manager.provider.SessionRead(sid)
return
}
// Start session gc process.
// it can do gc in times after gc lifetime.
func (manager *Manager) GC() {
manager.provider.SessionGC()
2014-01-05 06:48:36 +00:00
time.AfterFunc(time.Duration(manager.config.Gclifetime)*time.Second, func() { manager.GC() })
}
// Regenerate a session id for this SessionStore who's id is saving in http request.
2013-09-26 10:07:00 +00:00
func (manager *Manager) SessionRegenerateId(w http.ResponseWriter, r *http.Request) (session SessionStore) {
sid := manager.sessionId(r)
2014-01-05 06:48:36 +00:00
cookie, err := r.Cookie(manager.config.CookieName)
2013-09-26 10:07:00 +00:00
if err != nil && cookie.Value == "" {
//delete old cookie
session, _ = manager.provider.SessionRead(sid)
2014-01-05 06:48:36 +00:00
cookie = &http.Cookie{Name: manager.config.CookieName,
2013-09-26 10:07:00 +00:00
Value: url.QueryEscape(sid),
Path: "/",
HttpOnly: true,
2014-01-05 06:48:36 +00:00
Secure: manager.config.Secure,
2013-09-26 10:07:00 +00:00
}
} else {
oldsid, _ := url.QueryUnescape(cookie.Value)
session, _ = manager.provider.SessionRegenerate(oldsid, sid)
cookie.Value = url.QueryEscape(sid)
cookie.HttpOnly = true
cookie.Path = "/"
}
2014-02-21 17:04:47 +00:00
if manager.config.CookieLifeTime >= 0 {
cookie.MaxAge = manager.config.CookieLifeTime
2013-09-26 10:07:00 +00:00
}
http.SetCookie(w, cookie)
r.AddCookie(cookie)
return
}
// Get all active sessions count number.
2013-11-01 16:16:10 +00:00
func (manager *Manager) GetActiveSession() int {
return manager.provider.SessionAll()
}
// Set hash function for generating session id.
2013-11-05 13:59:35 +00:00
func (manager *Manager) SetHashFunc(hasfunc, hashkey string) {
2014-01-05 06:48:36 +00:00
manager.config.SessionIDHashFunc = hasfunc
manager.config.SessionIDHashKey = hashkey
2013-11-05 13:59:35 +00:00
}
2013-09-26 10:07:00 +00:00
// Set cookie with https.
2013-11-05 13:59:35 +00:00
func (manager *Manager) SetSecure(secure bool) {
2014-01-05 06:48:36 +00:00
manager.config.Secure = secure
2013-11-05 13:59:35 +00:00
}
// generate session id with rand string, unix nano time, remote addr by hash function.
2013-09-26 10:07:00 +00:00
func (manager *Manager) sessionId(r *http.Request) (sid string) {
2013-10-21 14:06:30 +00:00
bs := make([]byte, 24)
if _, err := io.ReadFull(rand.Reader, bs); err != nil {
return ""
}
2013-09-26 10:07:00 +00:00
sig := fmt.Sprintf("%s%d%s", r.RemoteAddr, time.Now().UnixNano(), bs)
2014-01-05 06:48:36 +00:00
if manager.config.SessionIDHashFunc == "md5" {
2013-09-26 10:07:00 +00:00
h := md5.New()
2013-10-21 14:06:30 +00:00
h.Write([]byte(sig))
sid = hex.EncodeToString(h.Sum(nil))
2014-01-05 06:48:36 +00:00
} else if manager.config.SessionIDHashFunc == "sha1" {
h := hmac.New(sha1.New, []byte(manager.config.SessionIDHashKey))
2013-09-26 10:07:00 +00:00
fmt.Fprintf(h, "%s", sig)
2013-10-21 14:06:30 +00:00
sid = hex.EncodeToString(h.Sum(nil))
2013-09-26 10:07:00 +00:00
} else {
2014-01-05 06:48:36 +00:00
h := hmac.New(sha1.New, []byte(manager.config.SessionIDHashKey))
2013-09-26 10:07:00 +00:00
fmt.Fprintf(h, "%s", sig)
2013-10-21 14:06:30 +00:00
sid = hex.EncodeToString(h.Sum(nil))
2013-09-26 10:07:00 +00:00
}
return
}