Web.ServerSession.Frontend.Snap.Internal

Internal module exposing the guts of the package. Use at your own risk. No API stability guarantees apply.

Documentation

initServerSessionManager :: (Storage sto, SnapSession (SessionData sto)) => IO (State sto) -> SnapletInit b SessionManager

Create a new ServerSessionManager using the given State.

simpleServerSessionManager :: (Storage sto, SessionData sto ~ SessionMap) => IO sto -> (State sto -> State sto) -> SnapletInit b SessionManager

Simplified version of initServerSessionManager, sufficient for most needs.

class IsSessionData sess => SnapSession sess where

Class for data types that implement the operations Snap expects sessions to support.

Methods

ssInsert :: Text -> Text -> sess -> sess

ssLookup :: Text -> sess -> Maybe Text

ssDelete :: Text -> sess -> sess

ssToList :: sess -> [(Text, Text)]

ssInsertCsrf :: Text -> sess -> sess

ssLookupCsrf :: sess -> Maybe Text

ssForceInvalidate :: ForceInvalidate -> sess -> sess

Instances

SnapSession SessionMap

Uses csrfKey.

data ServerSessionManager sto

A ISessionManager using server-side sessions.

Constructors

ServerSessionManager

Fields

currentSession :: Maybe (SessionData sto, SaveSessionToken sto)

Field used for per-request caching of the session.

state :: State sto

The core serversession state.

cookieName :: ByteString

Cache of the cookie name as bytestring.

nonceGen :: Generator

Nonce generator for the CSRF token.

Instances

(Storage sto, SnapSession (SessionData sto)) => ISessionManager (ServerSessionManager sto)

Typeable (* -> *) ServerSessionManager

currentSessionMap :: String -> ServerSessionManager sto -> SessionData sto

Get the current SessionData from currentSession and unwrap its Just. If it's Nothing, error is called. We expect load to be called before any other ISessionManager method.

modifyCurrentSession :: (SessionData sto -> SessionData sto) -> ServerSessionManager sto -> ServerSessionManager sto

Modify the current session in any way.

createCookie :: State sto -> ByteString -> Session sess -> Cookie

Create a cookie for the given session.

The cookie expiration is set via nextExpires. Note that this is just an optimization, as the expiration is checked on the server-side as well.

csrfKey :: Text

The CSRF key is kept as a session variable like any other under this key.

forceInvalidate :: ForceInvalidate -> Handler b SessionManager ()

Invalidate the current session ID (and possibly more, check ForceInvalidate). This is useful to avoid session fixation attacks (cf. http://www.acrossecurity.com/papers/session_fixation.pdf).

Note that the invalidate does not occur when the call to this action is made! The sessions will be invalidated when the session is commited. This means that later calls to forceInvalidate on the same handler will override earlier calls.

This function works by setting a session variable that is checked when saving the session. The session variable set by this function is then discarded and is not persisted across requests.