data Bezel::Session
The session's values, which Plug::Session loads from its store
(Session::Store) and writes back when they changed; empty, and not
loaded, without that plug. Values are strings (an application
stores ids, not objects).
Classes and modules
Bezel::Session::CookieStoreA session kept in a cookie: its values as JSON, encrypted and authenticated with AES-256-GCM under a key derived from SECRET_KEY_BASE (Keys), the cookie's name as associated data. A cookie that does not decrypt (another secret, tampered with, another cookie's) reads as an empty session. The cookie is HttpOnly, SameSite=Lax, Path=/ and Secure outside dev, by default; a session over MAX_BYTES once encoded is a Bezel::CookieOverflow.Bezel::Session::StoreWhere a session lives between requests: Plug::Session loads it for a request and saves it when it changed. Session::CookieStore keeps it in an encrypted cookie; a store on the server (rotor-backed) can come later behind the same interface.
Methods
def values -> Hash[String, String]
def changed -> Bool
def dropped -> Bool
def loaded -> Bool
def with(*, values: Hash[String, String] = …, changed: Bool = …, dropped: Bool = …, loaded: Bool = …) -> Bezel::Session
A copy with the fields given replaced.
def to_h -> Hash[Symbol, Object]
The fields as a Hash, by name.
def [](key: String) -> String?
The value of key, or nil.
def put(key: String, value: String) -> Bezel::Session
The session with key set to value.
(After drop, a value put starts a new session: logging in after
dropping the old one.)
def delete(key: String) -> Bezel::Session
The session without key.
def drop -> Bezel::Session
The session dropped (logging out): none of its values kept, but a
fresh CSRF secret when it had one; a store deletes its cookie when
nothing is left, else writes the new one.
The CSRF secret goes too, replaced by a fresh one when the session had
one, so that a page rendered after drop has a token that holds.
def renew -> Bezel::Session
The session with a new CSRF secret (when it had one): the values
stay, so that a page rendered after it carries a token of the new
secret. Against a session planted before a login, drop then put
the user's id: renew keeps whatever else the planted cookie held.
(A server-side store would change its id here too.)