chickadee » http-session

http-session

Introduction

http-session is an implementation of facilities for managing HTTP sessions of web applications.

Author

Mario Domenech Goulart

Repository

https://github.com/mario-goulart/http-session/

Requirements

API

Parameters

session-lifetime
session-lifetime #!optional numberparameter

The lifetime of sessions in seconds. Default is 3600s (1h).

session-id-generator
session-id-generator #!optional procedureparameter

A zero argument procedure which generates a random unique identifier for sessions. Defaults to a procedure which concatenates current-milliseconds with the process ID and a random number between 0 and 1000 plus the current-process-id and returns its SHA-1 digest.

match-ip-address?
match-ip-address? #!optional booleanparameter

Indicates whether http-session should match IP addresses to check if sessions are valid.

Procedures

session-create
session-create #!optional (bindings '())procedure

Creates a session and returns the session identifier.

The optional bindings argument is an alist '((symbol . value)...) of variable bindings valid for the generated session.

session-refresh!
session-refresh! sidprocedure

Refreshes the session identified by sid, that is, sets the lifetime of the session identified by sid to (session-lifetime).

session-valid?
session-valid? sidprocedure

Returns #t if the session identified by sid is valid. Returns #f otherwise.

A session is valid if (all items should be satisfied):

  • There is a session identifier equal to sid in the session table
  • The session lifetime corresponding to the session identified by sid is greater than zero
  • When match-ip-address? is not #f, the IP number corresponding to the session identified by sid matches the IP number of the client
session-destroy!
session-destroy! sidprocedure

Destroys the session identified by sid.

session-ref
session-ref sid var #!optional defaultprocedure

Returns the value corresponding to VAR from the bindings alist of the session identified by sid. If the binding does not exist, DEFAULT is returned.

session-set!
session-set! sid var valprocedure

Sets a value VAL for the VAR symbol in the bindings alist for the session identified by sid. If the symbol does not exist in the bindings alist, it is added to it.

session-del!
session-del! sid varprocedure

Deletes the VAR symbol and its corresponding value from the bindings alist of the session identified by sid.

session-bindings
session-bindings sidprocedure

Returns an alist '((variable . value) ... ) representing the bindings of the session identified by sid.

session-set-finalizer!
session-set-finalizer! sid procprocedure

Sets a finalizer procedure (proc) for the session identified by sid. proc is an one-argument procedure which receives the session identifier as argument and is executed right before the session is destroyed.

Configurable storage backend API

session-storage-initialize
session-storage-initializeparameter

A procedure that returns the session storage. The object returned by the default procedure is a hash-table.

session-storage-set!
session-storage-set!parameter

A two-argument procedure (sid and session-item) that sets the given session-item in the session storage for sid.

session-storage-ref
session-storage-refparameter

A one-argument procedure that given the session identifier returns the corresponding session item.

session-storage-delete!
session-storage-delete!parameter

A one-argument procedure that deletes the session item correspoding to the given session identifier.

File-based backend storage example

Here's an example using awful. http-session keeps the session in a file-based backend storage.

 (use awful http-session)
 
 (define (session-item->list session-item)
   (list (session-item-expiration session-item)
         (session-item-ip session-item)
         (session-item-bindings session-item)
         (session-item-finalizer session-item)))
 
 (define (list->session-item l)
   (apply make-session-item l))
 
 (session-storage-initialize
  (lambda ()
    (let ((dir (create-temporary-directory)))
      (print "Using " dir " as sessions-dir.")
      dir)))
 
 (session-storage-set!
  (lambda (sid session-item)
    (with-output-to-file (make-pathname (session-storage) sid)
      (lambda ()
        (pp (session-item->list session-item))))))
 
 (session-storage-ref
  (lambda (sid)
    (let ((data (with-input-from-file
                    (make-pathname (session-storage) sid)
                  read)))
      (list->session-item data))))
 
 (session-storage-delete!
  (lambda (sid)
    (delete-file* (make-pathname (session-storage) sid))))
 
 
 ;; awful pages
 (define-session-page (main-page-path)
   (lambda ()
     (with-request-variables (foo)
       ($session-set! 'foo foo)
       (string-append "foo set to " (->string foo)))))
 
 (define-session-page "/foo"
   (lambda ()
     (->string ($session 'foo))))

Usage example

Web server

(use spiffy web-scheme-handler http-session html-tags html-utils spiffy-request-vars)
(file-extension-handlers `(("ws" . ,web-scheme-handler)))
(start-server)

index.ws

(define (page:next sid)
  (html-page
   (string-append
    (<h1> (let ((n (add1 (session-ref sid 'n 0))))
            (session-set! sid 'n n)
            (number->string n)))
    (<a> href: (string-append "?sid=" sid) "Next"))))

(let ((sid ((request-vars) 'sid)))
  (if sid
      (if (session-valid? sid)
          (begin (session-refresh! sid)
                 (page:next sid))
          (html-page "Invalid session."))
      (let ((sid (session-create)))
        (page:next sid))))

License

 Copyright (c) 2010-2018, Mario Domenech Goulart
 All rights reserved.
 
 Redistribution and use in source and binary forms, with or without
 modification, are permitted provided that the following conditions
 are met:
 1. Redistributions of source code must retain the above copyright
    notice, this list of conditions and the following disclaimer.
 2. Redistributions in binary form must reproduce the above copyright
    notice, this list of conditions and the following disclaimer in the
    documentation and/or other materials provided with the distribution.
 3. The name of the authors may not be used to endorse or promote products
    derived from this software without specific prior written permission.
 
 THIS SOFTWARE IS PROVIDED BY THE AUTHORS ``AS IS'' AND ANY EXPRESS
 OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
 WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
 ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHORS BE LIABLE FOR ANY
 DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
 DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE
 GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
 INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER
 IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
 OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN
 IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

Version History

Version 2.10

Version 2.9

Version 2.8

Version 2.7

Version 2.6

Version 2.5

Version 2.4

Version 2.3

Version 2.2

Version 2.1

Version 2.0

Version 1.2.3

Version 1.2.2

Version 1.2

Version 1.1

Version 1.0

Contents »