class Bezel::Session::CookieStore
include Bezel::Session::Store
A session kept in a cookie: its values as JSON, encrypted and
authenticated with AES-256-GCM under a key derived from
SECRET_KEY_BASE (Keys), the cookie's name as associated data. A
cookie that does not decrypt (another secret, tampered with, another
cookie's) reads as an empty session. The cookie is HttpOnly,
SameSite=Lax, Path=/ and Secure outside dev, by default; a
session over MAX_BYTES once encoded is a Bezel::CookieOverflow.
The values can be read by nobody without the secret, but the cookie as
a whole can be replayed: logging out replaces it in the browser, not
from a copy someone kept. With max_age, the cookie holds its expiry
(set when it is written), and an older one reads as empty: the
session ends max_age after its last change, whatever the browser
keeps (turning max_age on reads the cookies written before as empty:
their sessions end). What must be revocable belongs in the database, the session
holding its id. A cookie name with the __Host- prefix (with
secure: true) keeps sibling subdomains from planting one.
Constants
MAX_BYTES: Int
The cookie's size limit, its value encoded (browsers keep 4096 bytes per cookie, its name and attributes included).
EXPIRES: String
The key of the expiry kept in the cookie with max_age (seconds since
the epoch), never one of the session's values.
Class methods
def self.new(*, key: String, max_age: Int? = …, secure: Bool? = …, same_site: String = …, domain: String? = …) -> Bezel::Session::CookieStore
A store in the cookie key, kept max_age seconds (nil: until the
browser closes), Secure when secure (nil: outside dev).
Methods
def key -> String
The cookie's name.
def load(conn: Bezel::Conn) -> Bezel::Session
The session of conn's request (an empty one when there is none, or
it does not read back).
def save(conn: Bezel::Conn, session: Bezel::Session) -> Bezel::Conn
conn with its session saved (a cookie set, or deleted when the
session is empty). A dropped session may have values: a new
session's.