Can two different controllers in two different files reference the same session object successfully?

[darienmiller88]

Can two different controllers in two different files reference the same session object successfully?

[elithrar]

Two quick observations: • you don’t appear to save the session in the first controller • you generate a random key at startup, which means all previously issued cookies cannot be decoded when you restart your app during development

[darienmiller88]

Ahh, I forgot to add the first part to my original question. And I didn't realize that the random key was problematic in that way, thanks. Changing this results in the ViewsController referencing an existing session created in the UserController instead of a new one previously, but all of the values added to the "Values" map by that same Controller are still not there for whatever reason. I have added an "isAuth" method to both the ViewsController and UserController to check to see the users that were added the "Values" map :

func  isAuth(res http.ResponseWriter, req *http.Request){
	newSession, _ := session.Store.Get(req, "cookie-name")
	 user, ok := newSession.Values["user"].(models.User)

	if !user.Authenticated || !ok{
		newSession.Save(req, res)
		res.WriteHeader(http.StatusUnauthorized)
		render.JSON(res, req,  m{"error": "not authorized})
		return
	}

	fmt.Println("values:", newSession.Values, "and user", user)//Prints expected values in the UserController, but not for the ViewsController
	render.JSON(res, req, user)
}

When this method is hit in the UserController, it returns session values as expected, but when the same method is hit in the ViewsController, the session values map is still empty.

[darienmiller88]

Okay, so I noticed that when session values are saved on a particular path prefix, they can ONLY be accessed on those path prefixes, and not anywhere else. I'm not sure if that's by design, or if there's something I have to change in my code to give every path access to the users in the session, but I was considering wrapping the *sessions.CookieStore object in a struct with a map[interface{}]interface{} field as an accompanying field to store the session values to allow for persistence.

[elithrar]

That's how cookies work: they are only sent when the (domain, path, secure) tuple match - MDN - https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies#define_where_cookies_are_sent If you wrap the CookieStore in a global map, it won't be concurrency safe. Have you considered using a request context to share values during a single request's lifecycle?

…

[darienmiller88]

Sorry for the absence, I ran into a few hurdles along the way. So in my "session" package where I have my "Store" object of type *sessions.CookieStore, I also have a "Ctx" object of type context.Context which both my ViewsController and UserController access, with the UserController sending user data into the context, and the ViewsController accessing them to render the pages using that data. Is this way concurrency safe?

[elithrar]

If the context is only on the same request, then the context is safe within that request. If the context is NOT request scoped and you're passing the same data around across requests, it will not be concurrency safe.

…

On Mon, May 10, 2021 at 11:21 AM darienmiller88 ***@***.***> wrote: Sorry for the absence, I ran into a few hurdles along the way. So in my "session" package where I have my "Store" object of type *sessions.CookieStore, I also have a "Ctx" object of type context.Context which both my ViewsController and UserController access, with the UserController sending user data into the context, and the ViewsController accessing them to render the pages using that data. Is this way concurrency safe? — You are receiving this because you commented. Reply to this email directly, view it on GitHub <#239 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAAEQ4FRHFUIHW64FWFILP3TNAP4DANCNFSM44DKMNFQ> .

[darienmiller88]

I'm storing values in a global context object in my session package, and I have both my Views and User controllers store and retrieve values from it, so I appear to be doing the latter. The challenge I'm having then is how to I send a request scope context from one controller to another? On the front end, after the user signs in, Javascript sends the data to my UserController via fetch request, which is then intercepted by a middleware that parses the data into a User object, which is then put into a request scoped context and sent to the /api/users/signin route. That route then stores the user in a session, and sends JSON back to the frontend, which then reroutes to the / route. I'm not sure how to restructure my code to allow requests scoped contexts to be sent from one controller serving one path prefix to another controller serving another. Is there a particular model or pattern I have to follow?

[stale]

This issue has been automatically marked as stale because it hasn't seen a recent update. It'll be automatically closed in a few days.