1
0
mirror of https://github.com/astaxie/beego.git synced 2024-11-10 21:30:55 +00:00
Beego/session/session.go

378 lines
11 KiB
Go
Raw Normal View History

2014-08-18 08:41:43 +00:00
// Copyright 2014 beego Author. All Rights Reserved.
2014-07-03 15:40:21 +00:00
//
2014-08-18 08:41:43 +00:00
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
2014-07-03 15:40:21 +00:00
//
2014-08-18 08:41:43 +00:00
// http://www.apache.org/licenses/LICENSE-2.0
2014-07-03 15:40:21 +00:00
//
2014-08-18 08:41:43 +00:00
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
2015-09-12 14:53:55 +00:00
// Package session provider
2014-08-18 08:41:43 +00:00
//
// Usage:
// import(
// "github.com/astaxie/beego/session"
// )
//
// func init() {
2016-01-11 08:49:56 +00:00
// globalSessions, _ = session.NewManager("memory", `{"cookieName":"gosessionid", "enableSetCookie,omitempty": true, "gclifetime":3600, "maxLifetime": 3600, "secure": false, "cookieLifeTime": 3600, "providerConfig": ""}`)
2014-08-18 08:41:43 +00:00
// go globalSessions.GC()
// }
2014-07-03 15:40:21 +00:00
//
2014-08-18 08:41:43 +00:00
// more docs: http://beego.me/docs/module/session.md
package session
import (
"crypto/rand"
2013-09-26 10:07:00 +00:00
"encoding/hex"
"errors"
"fmt"
"io"
"log"
"net/http"
"net/textproto"
"net/url"
"os"
"time"
)
2015-09-12 14:53:55 +00:00
// Store contains all data for one session process with specific id.
type Store interface {
2014-01-05 06:48:36 +00:00
Set(key, value interface{}) error //set session value
Get(key interface{}) interface{} //get session value
Delete(key interface{}) error //delete session value
SessionID() string //back current sessionID
SessionRelease(w http.ResponseWriter) // release the resource & save data to provider & return the data
Flush() error //delete all data
}
// Provider contains global session methods and saved SessionStores.
// it can operate a SessionStore by its id.
type Provider interface {
2014-01-05 06:48:36 +00:00
SessionInit(gclifetime int64, config string) error
2015-09-12 14:53:55 +00:00
SessionRead(sid string) (Store, error)
2013-11-05 14:23:48 +00:00
SessionExist(sid string) bool
2015-09-12 14:53:55 +00:00
SessionRegenerate(oldsid, sid string) (Store, error)
SessionDestroy(sid string) error
2013-11-01 16:16:10 +00:00
SessionAll() int //get all active session
SessionGC()
}
var provides = make(map[string]Provider)
2016-03-25 02:48:59 +00:00
// SLogger a helpful variable to log information about session
var SLogger = NewSessionLog(os.Stderr)
// Register makes a session provide available by the provided name.
// If Register is called twice with the same name or if driver is nil,
// it panics.
func Register(name string, provide Provider) {
if provide == nil {
panic("session: Register provide is nil")
}
if _, dup := provides[name]; dup {
panic("session: Register called twice for provider " + name)
}
provides[name] = provide
}
2018-12-13 07:37:19 +00:00
//GetProvider
func GetProvider(name string) (Provider, error) {
provider, ok := provides[name]
if !ok {
return nil, fmt.Errorf("session: unknown provide %q (forgotten import?)", name)
}
return provider, nil
}
2017-04-30 14:41:23 +00:00
// ManagerConfig define the session config
2016-08-13 13:07:27 +00:00
type ManagerConfig struct {
CookieName string `json:"cookieName"`
EnableSetCookie bool `json:"enableSetCookie,omitempty"`
Gclifetime int64 `json:"gclifetime"`
Maxlifetime int64 `json:"maxLifetime"`
2016-10-10 14:50:34 +00:00
DisableHTTPOnly bool `json:"disableHTTPOnly"`
Secure bool `json:"secure"`
CookieLifeTime int `json:"cookieLifeTime"`
ProviderConfig string `json:"providerConfig"`
Domain string `json:"domain"`
SessionIDLength int64 `json:"sessionIDLength"`
2017-04-30 14:41:23 +00:00
EnableSidInHTTPHeader bool `json:"EnableSidInHTTPHeader"`
SessionNameInHTTPHeader string `json:"SessionNameInHTTPHeader"`
EnableSidInURLQuery bool `json:"EnableSidInURLQuery"`
2018-10-10 03:02:45 +00:00
SessionIDPrefix string `json:"sessionIDPrefix"`
2014-01-05 06:48:36 +00:00
}
// Manager contains Provider and its configuration.
type Manager struct {
2014-01-05 06:48:36 +00:00
provider Provider
2016-08-13 13:07:27 +00:00
config *ManagerConfig
}
2015-09-12 14:53:55 +00:00
// NewManager Create new Manager with provider name and json config string.
// provider name:
// 1. cookie
// 2. file
// 3. memory
// 4. redis
// 5. mysql
// json config:
// 1. is https default false
// 2. hashfunc default sha1
// 3. hashkey default beegosessionkey
// 4. maxage default is none
2016-08-13 13:07:27 +00:00
func NewManager(provideName string, cf *ManagerConfig) (*Manager, error) {
provider, ok := provides[provideName]
if !ok {
return nil, fmt.Errorf("session: unknown provide %q (forgotten import?)", provideName)
}
2016-08-13 13:07:27 +00:00
if cf.Maxlifetime == 0 {
cf.Maxlifetime = cf.Gclifetime
}
2017-04-30 14:41:23 +00:00
if cf.EnableSidInHTTPHeader {
if cf.SessionNameInHTTPHeader == "" {
panic(errors.New("SessionNameInHTTPHeader is empty"))
}
2017-04-30 14:41:23 +00:00
strMimeHeader := textproto.CanonicalMIMEHeaderKey(cf.SessionNameInHTTPHeader)
if cf.SessionNameInHTTPHeader != strMimeHeader {
strErrMsg := "SessionNameInHTTPHeader (" + cf.SessionNameInHTTPHeader + ") has the wrong format, it should be like this : " + strMimeHeader
2016-04-27 14:18:22 +00:00
panic(errors.New(strErrMsg))
}
}
2016-08-13 13:07:27 +00:00
err := provider.SessionInit(cf.Maxlifetime, cf.ProviderConfig)
2014-01-08 15:24:31 +00:00
if err != nil {
return nil, err
}
2014-11-04 11:04:26 +00:00
2015-09-12 14:53:55 +00:00
if cf.SessionIDLength == 0 {
cf.SessionIDLength = 16
2013-10-28 13:44:07 +00:00
}
2014-01-05 06:48:36 +00:00
2013-09-26 10:07:00 +00:00
return &Manager{
2014-01-05 06:48:36 +00:00
provider,
cf,
2013-09-26 10:07:00 +00:00
}, nil
}
2018-11-14 11:24:10 +00:00
// GetProvider return current manager's provider
2018-08-28 19:12:28 +00:00
func (manager *Manager) GetProvider() Provider {
return manager.provider
}
// getSid retrieves session identifier from HTTP Request.
// First try to retrieve id by reading from cookie, session cookie name is configurable,
// if not exist, then retrieve id from querying parameters.
//
// error is not nil when there is anything wrong.
// sid is empty when need to generate a new session id
// otherwise return an valid session id.
func (manager *Manager) getSid(r *http.Request) (string, error) {
2014-11-04 11:04:26 +00:00
cookie, errs := r.Cookie(manager.config.CookieName)
2016-08-13 13:07:27 +00:00
if errs != nil || cookie.Value == "" {
var sid string
2017-04-30 14:41:23 +00:00
if manager.config.EnableSidInURLQuery {
errs := r.ParseForm()
if errs != nil {
return "", errs
}
sid = r.FormValue(manager.config.CookieName)
}
// if not found in Cookie / param, then read it from request headers
2017-04-30 14:41:23 +00:00
if manager.config.EnableSidInHTTPHeader && sid == "" {
sids, isFound := r.Header[manager.config.SessionNameInHTTPHeader]
if isFound && len(sids) != 0 {
return sids[0], nil
}
2013-11-05 14:23:48 +00:00
}
return sid, nil
}
// HTTP Request contains cookie for sessionid info.
return url.QueryUnescape(cookie.Value)
}
2015-12-27 06:09:20 +00:00
// SessionStart generate or read the session id from http request.
// if session id exists, return SessionStore with this id.
2015-12-27 06:09:20 +00:00
func (manager *Manager) SessionStart(w http.ResponseWriter, r *http.Request) (session Store, err error) {
sid, errs := manager.getSid(r)
if errs != nil {
return nil, errs
}
if sid != "" && manager.provider.SessionExist(sid) {
return manager.provider.SessionRead(sid)
}
// Generate a new session
2016-01-11 08:49:56 +00:00
sid, errs = manager.sessionID()
if errs != nil {
return nil, errs
}
session, err = manager.provider.SessionRead(sid)
2016-08-13 13:07:27 +00:00
if err != nil {
return nil, err
2016-08-13 13:07:27 +00:00
}
cookie := &http.Cookie{
Name: manager.config.CookieName,
Value: url.QueryEscape(sid),
Path: "/",
2016-10-10 14:50:34 +00:00
HttpOnly: !manager.config.DisableHTTPOnly,
Secure: manager.isSecure(r),
Domain: manager.config.Domain,
}
if manager.config.CookieLifeTime > 0 {
cookie.MaxAge = manager.config.CookieLifeTime
cookie.Expires = time.Now().Add(time.Duration(manager.config.CookieLifeTime) * time.Second)
}
if manager.config.EnableSetCookie {
http.SetCookie(w, cookie)
}
r.AddCookie(cookie)
2017-04-30 14:41:23 +00:00
if manager.config.EnableSidInHTTPHeader {
r.Header.Set(manager.config.SessionNameInHTTPHeader, sid)
w.Header().Set(manager.config.SessionNameInHTTPHeader, sid)
}
return
}
2015-09-12 14:53:55 +00:00
// SessionDestroy Destroy session by its id in http request cookie.
func (manager *Manager) SessionDestroy(w http.ResponseWriter, r *http.Request) {
2017-04-30 14:41:23 +00:00
if manager.config.EnableSidInHTTPHeader {
r.Header.Del(manager.config.SessionNameInHTTPHeader)
w.Header().Del(manager.config.SessionNameInHTTPHeader)
}
2014-01-05 06:48:36 +00:00
cookie, err := r.Cookie(manager.config.CookieName)
if err != nil || cookie.Value == "" {
return
}
2016-03-01 05:39:36 +00:00
sid, _ := url.QueryUnescape(cookie.Value)
manager.provider.SessionDestroy(sid)
2016-01-07 05:15:40 +00:00
if manager.config.EnableSetCookie {
expiration := time.Now()
cookie = &http.Cookie{Name: manager.config.CookieName,
Path: "/",
2016-10-10 14:50:34 +00:00
HttpOnly: !manager.config.DisableHTTPOnly,
2016-01-07 05:15:40 +00:00
Expires: expiration,
2019-11-19 13:25:30 +00:00
MaxAge: -1,
Domain: manager.config.Domain}
2016-01-07 05:15:40 +00:00
http.SetCookie(w, cookie)
}
}
2015-09-12 14:53:55 +00:00
// GetSessionStore Get SessionStore by its id.
func (manager *Manager) GetSessionStore(sid string) (sessions Store, err error) {
2013-10-28 15:25:30 +00:00
sessions, err = manager.provider.SessionRead(sid)
return
}
2015-09-12 14:53:55 +00:00
// GC Start session gc process.
// it can do gc in times after gc lifetime.
func (manager *Manager) GC() {
manager.provider.SessionGC()
2014-01-05 06:48:36 +00:00
time.AfterFunc(time.Duration(manager.config.Gclifetime)*time.Second, func() { manager.GC() })
}
2015-09-12 14:53:55 +00:00
// SessionRegenerateID Regenerate a session id for this SessionStore who's id is saving in http request.
func (manager *Manager) SessionRegenerateID(w http.ResponseWriter, r *http.Request) (session Store) {
2016-01-11 08:49:56 +00:00
sid, err := manager.sessionID()
2014-11-04 11:04:26 +00:00
if err != nil {
return
}
2014-01-05 06:48:36 +00:00
cookie, err := r.Cookie(manager.config.CookieName)
2016-01-07 05:15:40 +00:00
if err != nil || cookie.Value == "" {
2013-09-26 10:07:00 +00:00
//delete old cookie
session, _ = manager.provider.SessionRead(sid)
2014-01-05 06:48:36 +00:00
cookie = &http.Cookie{Name: manager.config.CookieName,
2013-09-26 10:07:00 +00:00
Value: url.QueryEscape(sid),
Path: "/",
2016-10-10 14:50:34 +00:00
HttpOnly: !manager.config.DisableHTTPOnly,
2015-05-15 07:04:08 +00:00
Secure: manager.isSecure(r),
2014-08-04 08:21:06 +00:00
Domain: manager.config.Domain,
2013-09-26 10:07:00 +00:00
}
} else {
oldsid, _ := url.QueryUnescape(cookie.Value)
session, _ = manager.provider.SessionRegenerate(oldsid, sid)
cookie.Value = url.QueryEscape(sid)
cookie.HttpOnly = true
cookie.Path = "/"
}
if manager.config.CookieLifeTime > 0 {
2014-02-21 17:04:47 +00:00
cookie.MaxAge = manager.config.CookieLifeTime
cookie.Expires = time.Now().Add(time.Duration(manager.config.CookieLifeTime) * time.Second)
2013-09-26 10:07:00 +00:00
}
2016-01-07 05:15:40 +00:00
if manager.config.EnableSetCookie {
http.SetCookie(w, cookie)
}
2013-09-26 10:07:00 +00:00
r.AddCookie(cookie)
2017-04-30 14:41:23 +00:00
if manager.config.EnableSidInHTTPHeader {
r.Header.Set(manager.config.SessionNameInHTTPHeader, sid)
w.Header().Set(manager.config.SessionNameInHTTPHeader, sid)
}
2013-09-26 10:07:00 +00:00
return
}
2015-09-12 14:53:55 +00:00
// GetActiveSession Get all active sessions count number.
2013-11-01 16:16:10 +00:00
func (manager *Manager) GetActiveSession() int {
return manager.provider.SessionAll()
}
2015-09-12 14:53:55 +00:00
// SetSecure Set cookie with https.
2013-11-05 13:59:35 +00:00
func (manager *Manager) SetSecure(secure bool) {
2014-01-05 06:48:36 +00:00
manager.config.Secure = secure
2013-11-05 13:59:35 +00:00
}
2016-01-11 08:49:56 +00:00
func (manager *Manager) sessionID() (string, error) {
2015-09-12 14:53:55 +00:00
b := make([]byte, manager.config.SessionIDLength)
2014-11-04 11:04:26 +00:00
n, err := rand.Read(b)
if n != len(b) || err != nil {
2017-04-30 14:41:23 +00:00
return "", fmt.Errorf("Could not successfully read from the system CSPRNG")
2013-09-26 10:07:00 +00:00
}
2018-11-05 01:51:27 +00:00
return manager.config.SessionIDPrefix + hex.EncodeToString(b), nil
}
2015-05-15 07:04:08 +00:00
// Set cookie with https.
func (manager *Manager) isSecure(req *http.Request) bool {
if !manager.config.Secure {
return false
}
if req.URL.Scheme != "" {
return req.URL.Scheme == "https"
}
if req.TLS == nil {
return false
}
return true
}
// Log implement the log.Logger
2016-03-25 02:48:59 +00:00
type Log struct {
*log.Logger
}
2016-03-25 02:48:59 +00:00
// NewSessionLog set io.Writer to create a Logger for session.
func NewSessionLog(out io.Writer) *Log {
sl := new(Log)
sl.Logger = log.New(out, "[SESSION]", 1e9)
return sl
}