From d8e9ea0856aaa9d3f4c434f24a01d37bb32db114 Mon Sep 17 00:00:00 2001 From: Yue1 <469960757@qq.com> Date: Tue, 23 Jun 2020 14:03:21 +0800 Subject: [PATCH 1/6] create session when sid get error, use a new session id --- session.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/session.go b/session.go index 1e18f9b..993e8c6 100644 --- a/session.go +++ b/session.go @@ -285,7 +285,7 @@ func (m *Manager) Start(ctx context.Context, w http.ResponseWriter, r *http.Requ sid, err := m.sessionID(r) if err != nil { - return nil, err + sid = "" } if sid != "" { From bd5c6985dd9317e177d45eb4e877d292d0e1cbf9 Mon Sep 17 00:00:00 2001 From: Yue1 <469960757@qq.com> Date: Tue, 23 Jun 2020 14:12:27 +0800 Subject: [PATCH 2/6] =?UTF-8?q?=E4=BE=9D=E8=B5=96=E6=9B=B4=E6=96=B0=20modu?= =?UTF-8?q?le=E6=94=AF=E6=8C=81=E4=BF=AE=E6=94=B9?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- go.mod | 4 ++-- go.sum | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/go.mod b/go.mod index eb4c65f..b386b6d 100644 --- a/go.mod +++ b/go.mod @@ -1,9 +1,9 @@ -module github.com/go-session/session +module github.com/edieruby/session/v3 go 1.14 require ( github.com/gopherjs/gopherjs v0.0.0-20200217142428-fce0ec30dd00 // indirect - github.com/smartystreets/assertions v1.1.0 // indirect + github.com/smartystreets/assertions v1.1.1 // indirect github.com/smartystreets/goconvey v1.6.4 ) diff --git a/go.sum b/go.sum index d2f0ef1..dff506f 100644 --- a/go.sum +++ b/go.sum @@ -5,8 +5,8 @@ github.com/jtolds/gls v4.20.0+incompatible h1:xdiiI2gbIgH/gLH7ADydsJ1uDOEzR8yvV7 github.com/jtolds/gls v4.20.0+incompatible/go.mod h1:QJZ7F/aHp+rZTRtaJ1ow/lLfFfVYBRgL+9YlvaHOwJU= github.com/smartystreets/assertions v0.0.0-20180927180507-b2de0cb4f26d h1:zE9ykElWQ6/NYmHa3jpm/yHnI4xSofP+UP6SpjHcSeM= github.com/smartystreets/assertions v0.0.0-20180927180507-b2de0cb4f26d/go.mod h1:OnSkiWE9lh6wB0YB77sQom3nweQdgAjqCqsofrRNTgc= -github.com/smartystreets/assertions v1.1.0 h1:MkTeG1DMwsrdH7QtLXy5W+fUxWq+vmb6cLmyJ7aRtF0= -github.com/smartystreets/assertions v1.1.0/go.mod h1:tcbTF8ujkAEcZ8TElKY+i30BzYlVhC/LOxJk7iOWnoo= +github.com/smartystreets/assertions v1.1.1 h1:T/YLemO5Yp7KPzS+lVtu+WsHn8yoSwTfItdAd1r3cck= +github.com/smartystreets/assertions v1.1.1/go.mod h1:tcbTF8ujkAEcZ8TElKY+i30BzYlVhC/LOxJk7iOWnoo= github.com/smartystreets/goconvey v1.6.4 h1:fv0U8FUIMPNf1L9lnHLvLhgicrIVChEkdzIKYqbNC9s= github.com/smartystreets/goconvey v1.6.4/go.mod h1:syvi0/a8iFYH4r/RixwvyeAJjdLS9QV7WQ/tjFTllLA= golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2 h1:VklqNMn3ovrHsnt90PveolxSbWFaJdECFbxSq0Mqo2M= From 67b10e8a5a6051e311d1a5ce3f1b3f2ba891c02d Mon Sep 17 00:00:00 2001 From: Yue1 <469960757@qq.com> Date: Tue, 23 Jun 2020 14:56:36 +0800 Subject: [PATCH 3/6] =?UTF-8?q?=E4=BD=BF=E7=94=A8mod=20=E6=B7=BB=E5=8A=A0?= =?UTF-8?q?=E4=BE=9D=E8=B5=96?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index 0d249d2..7d0a81c 100644 --- a/README.md +++ b/README.md @@ -9,7 +9,7 @@ ### Download and install ```bash -$ go get -v github.com/go-session/session +github.com/edieruby/session/v3 ``` ### Create file `server.go` From c36a6ee3b6d212630bba9e338617c2bac7010f42 Mon Sep 17 00:00:00 2001 From: Yue1 <469960757@qq.com> Date: Fri, 13 Nov 2020 10:39:38 +0800 Subject: [PATCH 4/6] dependence upgrade --- go.mod | 2 +- go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/go.mod b/go.mod index b386b6d..1ae5a90 100644 --- a/go.mod +++ b/go.mod @@ -4,6 +4,6 @@ go 1.14 require ( github.com/gopherjs/gopherjs v0.0.0-20200217142428-fce0ec30dd00 // indirect - github.com/smartystreets/assertions v1.1.1 // indirect + github.com/smartystreets/assertions v1.2.0 // indirect github.com/smartystreets/goconvey v1.6.4 ) diff --git a/go.sum b/go.sum index dff506f..aab4a91 100644 --- a/go.sum +++ b/go.sum @@ -5,8 +5,8 @@ github.com/jtolds/gls v4.20.0+incompatible h1:xdiiI2gbIgH/gLH7ADydsJ1uDOEzR8yvV7 github.com/jtolds/gls v4.20.0+incompatible/go.mod h1:QJZ7F/aHp+rZTRtaJ1ow/lLfFfVYBRgL+9YlvaHOwJU= github.com/smartystreets/assertions v0.0.0-20180927180507-b2de0cb4f26d h1:zE9ykElWQ6/NYmHa3jpm/yHnI4xSofP+UP6SpjHcSeM= github.com/smartystreets/assertions v0.0.0-20180927180507-b2de0cb4f26d/go.mod h1:OnSkiWE9lh6wB0YB77sQom3nweQdgAjqCqsofrRNTgc= -github.com/smartystreets/assertions v1.1.1 h1:T/YLemO5Yp7KPzS+lVtu+WsHn8yoSwTfItdAd1r3cck= -github.com/smartystreets/assertions v1.1.1/go.mod h1:tcbTF8ujkAEcZ8TElKY+i30BzYlVhC/LOxJk7iOWnoo= +github.com/smartystreets/assertions v1.2.0 h1:42S6lae5dvLc7BrLu/0ugRtcFVjoJNMC/N3yZFZkDFs= +github.com/smartystreets/assertions v1.2.0/go.mod h1:tcbTF8ujkAEcZ8TElKY+i30BzYlVhC/LOxJk7iOWnoo= github.com/smartystreets/goconvey v1.6.4 h1:fv0U8FUIMPNf1L9lnHLvLhgicrIVChEkdzIKYqbNC9s= github.com/smartystreets/goconvey v1.6.4/go.mod h1:syvi0/a8iFYH4r/RixwvyeAJjdLS9QV7WQ/tjFTllLA= golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2 h1:VklqNMn3ovrHsnt90PveolxSbWFaJdECFbxSq0Mqo2M= From cdd12312e3b6a5cb050cfa9e6942ed1469e08d0f Mon Sep 17 00:00:00 2001 From: Y <469960757@qq.com> Date: Wed, 10 Mar 2021 15:51:02 +0800 Subject: [PATCH 5/6] add samesite --- session.go | 10 ++++++++++ session_test.go | 2 ++ 2 files changed, 12 insertions(+) diff --git a/session.go b/session.go index 993e8c6..fb3ebc4 100644 --- a/session.go +++ b/session.go @@ -35,6 +35,7 @@ var defaultOptions = options{ }, enableSetCookie: true, enableSIDInURLQuery: true, + sameSite: http.SameSiteDefaultMode, } type options struct { @@ -42,6 +43,7 @@ type options struct { cookieName string cookieLifeTime int secure bool + sameSite http.SameSite domain string expired int64 sessionID IDHandlerFunc @@ -90,6 +92,12 @@ func SetSecure(secure bool) Option { } } +func SetSameSite(sameSite http.SameSite) Option { + return func(o *options) { + o.sameSite = sameSite + } +} + // SetExpired Set session expiration time (in seconds) func SetExpired(expired int64) Option { return func(o *options) { @@ -263,6 +271,8 @@ func (m *Manager) setCookie(sessionID string, w http.ResponseWriter, r *http.Req Domain: m.opts.domain, } + cookie.SameSite = m.opts.sameSite + if v := m.opts.cookieLifeTime; v > 0 { cookie.MaxAge = v cookie.Expires = time.Now().Add(time.Duration(v) * time.Second) diff --git a/session_test.go b/session_test.go index 58f3669..1f1ca2f 100644 --- a/session_test.go +++ b/session_test.go @@ -14,6 +14,8 @@ func TestSessionStart(t *testing.T) { cookieName := "test_session_start" manager := NewManager( SetCookieName(cookieName), + SetSameSite(http.SameSiteNoneMode), + SetSecure(true), ) ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { From 192bc86653cad9e746c30e63a9a6dff74b7eaa57 Mon Sep 17 00:00:00 2001 From: Y <469960757@qq.com> Date: Wed, 10 Mar 2021 16:08:41 +0800 Subject: [PATCH 6/6] security --- session.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/session.go b/session.go index fb3ebc4..9a6bb79 100644 --- a/session.go +++ b/session.go @@ -267,7 +267,7 @@ func (m *Manager) setCookie(sessionID string, w http.ResponseWriter, r *http.Req Value: cookieValue, Path: "/", HttpOnly: true, - Secure: m.isSecure(r), + Secure: m.opts.secure, Domain: m.opts.domain, }