iris-session梳理

kelly 等级 225 0 0

入口

api := iris.New()
api.Adapt(gm.NewSession())

session的构造

func NewSession() sessions.Sessions {
db := redis.New(rs.Config{Network: rs.DefaultRedisNetwork,
Addr: config.Instance().Redis.Address,
Password: config.Instance().Redis.Password,
Database: "",
MaxIdle: 0,
MaxActive: 0,
IdleTimeout: rs.DefaultRedisIdleTimeout,
Prefix: "",
MaxAgeSeconds: config.Instance().Redis.MaxAgeSeconds}) // optionally configure the bridge between your redis server

mySessions := sessions.New(sessions.Config{Cookie: configs.GetSessionConfig().Cookie, Expires: configs.GetSessionConfig().Expires})
mySessions.UseDatabase(db)
return mySessions
}

MaxAgeSeconds //指的是session在数据库存的有效期
Expires //指的是session的有效期

回到刚才的api.Adapt(gm.NewSession()),装饰器

func (s *sessions) Adapt(frame *iris.Policies) {
// for newcomers this maybe looks strange:
// Each policy is an adaptor too, so they all can contain an Adapt.
// If they contains an Adapt func then the policy is an adaptor too and this Adapt func is called
// by Iris on .Adapt(...)
policy := iris.SessionsPolicy{
Start: s.Start,
Destroy: s.Destroy,
}

policy.Adapt(frame)
func (s SessionsPolicy) Adapt(frame *Policies) {
   if s.Start != nil {
      frame.SessionsPolicy.Start = s.Start
   }
   if s.Destroy != nil {
      frame.SessionsPolicy.Destroy = s.Destroy
   }
}

使用

调用context.Session(),获取到session对象

func (ctx *Context) Session() Session {
   policy := ctx.framework.policies.SessionsPolicy
   if policy.Start == nil {
      ctx.framework.Log(DevMode,
         errSessionsPolicyIsMissing.Format(ctx.RemoteAddr(), ctx.framework.Config.VHost).Error())
      return nil
   }

   if ctx.session == nil {
      ctx.session = policy.Start(ctx.ResponseWriter, ctx.Request)
   }

   return ctx.session
}

如果session==nil,就会调用start

func (s *sessions) Start(res http.ResponseWriter, req *http.Request) iris.Session {
   var sess iris.Session

   cookieValue := GetCookie(s.config.Cookie, req)

   if cookieValue == "" { // cookie doesn't exists, let's generate a session and add set a cookie
      sid := SessionIDGenerator(s.config.CookieLength)

      sess = s.provider.Init(sid, s.config.Expires)
      cookie := &http.Cookie{}

      // The RFC makes no mention of encoding url value, so here I think to encode both sessionid key and the value using the safe(to put and to use as cookie) url-encoding
      cookie.Name = s.config.Cookie

      cookie.Value = sid
      cookie.Path = "/"
      if !s.config.DisableSubdomainPersistence {

         requestDomain := req.URL.Host
         if portIdx := strings.IndexByte(requestDomain, ':'); portIdx > 0 {
            requestDomain = requestDomain[0:portIdx]
         }
         if IsValidCookieDomain(requestDomain) {

            // RFC2109, we allow level 1 subdomains, but no further
            // if we have localhost.com , we want the localhost.cos.
            // so if we have something like: mysubdomain.localhost.com we want the localhost here
            // if we have mysubsubdomain.mysubdomain.localhost.com we want the .mysubdomain.localhost.com here
            // slow things here, especially the 'replace' but this is a good and understable( I hope) way to get the be able to set cookies from subdomains & domain with 1-level limit
            if dotIdx := strings.LastIndexByte(requestDomain, '.'); dotIdx > 0 {
               // is mysubdomain.localhost.com || mysubsubdomain.mysubdomain.localhost.com
               s := requestDomain[0:dotIdx] // set mysubdomain.localhost || mysubsubdomain.mysubdomain.localhost
               if secondDotIdx := strings.LastIndexByte(s, '.'); secondDotIdx > 0 {
                  //is mysubdomain.localhost ||  mysubsubdomain.mysubdomain.localhost
                  s = s[secondDotIdx+1:] // set to localhost || mysubdomain.localhost
               }
               // replace the s with the requestDomain before the domain's siffux
               subdomainSuff := strings.LastIndexByte(requestDomain, '.')
               if subdomainSuff > len(s) { // if it is actual exists as subdomain suffix
                  requestDomain = strings.Replace(requestDomain, requestDomain[0:subdomainSuff], s, 1) // set to localhost.com || mysubdomain.localhost.com
               }
            }
            // finally set the .localhost.com (for(1-level) || .mysubdomain.localhost.com (for 2-level subdomain allow)
            cookie.Domain = "." + requestDomain // . to allow persistence
         }

      }
      cookie.HttpOnly = true
      // MaxAge=0 means no 'Max-Age' attribute specified.
      // MaxAge<0 means delete cookie now, equivalently 'Max-Age: 0'
      // MaxAge>0 means Max-Age attribute present and given in seconds
      if s.config.Expires >= 0 {
         if s.config.Expires == 0 { // unlimited life
            cookie.Expires = CookieExpireUnlimited
         } else { // > 0
            cookie.Expires = time.Now().Add(s.config.Expires)
         }
         cookie.MaxAge = int(cookie.Expires.Sub(time.Now()).Seconds())
      }

      // encode the session id cookie client value right before send it.
      cookie.Value = s.encodeCookieValue(cookie.Value)

      AddCookie(cookie, res)
   } else {
      cookieValue = s.decodeCookieValue(cookieValue)

      sess = s.provider.Read(cookieValue, s.config.Expires)
   }
   return sess
}

再设置cookie.Domain的时候,req.URL作为服务端的时候,是没有Host信息的,所以cookie.Domain 会默认空串。

再看s.provider.Init

// Init creates the session and returns it
func (p *provider) Init(sid string, expires time.Duration) iris.Session {
newSession := p.newSession(sid, expires)
p.mu.Lock()
p.sessions[sid] = newSession
p.mu.Unlock()
return newSession
}

init的时候做了两件事:
1.newSession
2.将session存到p.sessions里面

// newSession returns a new session from sessionid
func (p *provider) newSession(sid string, expires time.Duration) *session {

   sess := &session{
      sid:      sid,
      provider: p,
      values:   p.loadSessionValues(sid),
      flashes:  make(map[string]*flashMessage),
   }

   if expires > 0 { // if not unlimited life duration and no -1 (cookie remove action is based on browser's session)
      time.AfterFunc(expires, func() {
         // the destroy makes the check if this session is exists then or not,
         // this is used to destroy the session from the server-side also
         // it's good to have here for security reasons, I didn't add it on the gc function to separate its action
         p.Destroy(sid)
      })
   }

   return sess
}

这里可以看到在配置文件中设置的expire 是用来起了一个定时任务,之后删掉这个session

func (p *provider) Destroy(sid string) {
   p.mu.Lock()
   if sess, found := p.sessions[sid]; found {
      sess.values = nil
      sess.flashes = nil
      delete(p.sessions, sid)
      p.updateDatabases(sid, nil)
   }
   p.mu.Unlock()
}

destory的时候:
如果没有删除:
1.从p.sessions里面删除
2.更新到数据库

收藏
评论区
守株待兔
最新文章
消息队列之Kafka详解 2021-03-14 22:22
Ngnix入门教程 2021-03-14 22:13

导读