Sessions

The web/session package provides server-side session management with session fixation protection and a pluggable store interface.

Import

import "github.com/thuongh2/go-security/web/session"

Store interface

type Store interface {
    Create(ctx context.Context) (Session, error)
    Get(ctx context.Context, id string) (Session, bool, error)
    Save(ctx context.Context, s Session) error
    Delete(ctx context.Context, id string) error
}

Implement Store against any backend (Redis, Postgres, DynamoDB). go-security-sql provides a production-ready store over Postgres/MySQL, or any SQL flavor via its pluggable Dialect — see go-security-sql. go-security-redis documents the contract for a Redis store — see go-security-redis.

MemoryStore

For development and tests:

store := session.NewMemoryStore(session.Options{
    IdleTimeout: 30 * time.Minute, // expires a session after this long without access
})
defer store.Close() // stops the background GC goroutine

MemoryStore starts a background GC goroutine on NewMemoryStore; call Close when the store is no longer needed to stop it. It is not safe for multi-instance deployments — use Redis in production.

Options

Field	Default	Meaning
`IdleTimeout`	`30m`	Expires a session after this long without access; access via `Store.Get` renews it
`AbsoluteTTL`	`0` (no absolute lifetime)	Expires a session this long after creation regardless of access
`GCInterval`	`5m`	How often the background sweeper reclaims expired sessions
`TokenBytes`	`32` (minimum)	Entropy of generated session ids

Session interface

type Session interface {
    ID() string
    Get(key string) (any, bool)
    Set(key string, val any)
    Delete(key string)
    Attributes() map[string]any
    CreatedAt() time.Time
    LastAccessed() time.Time
}

Attributes() returns a snapshot copy of all attributes — it’s what FixationProtect uses to copy state into a freshly minted session. The session id is carried in an HTTP cookie via CookieConfig and a small set of helper functions:

cfg := session.DefaultCookieConfig() // Name "SESSION", Path "/", Secure, HttpOnly, SameSite=Lax

session.WriteSessionCookie(w, cfg, sess.ID())
id, ok := session.ReadSessionCookie(r, cfg)
session.ClearSessionCookie(w, cfg)

WriteSessionCookie always forces HttpOnly: true regardless of cfg, so a misconfigured CookieConfig cannot ship a JS-readable session cookie.

CookieConfig fields

Field	Default	Meaning
`Name`	`SESSION`	Cookie name
`Path`	`/`	Cookie path
`Domain`	(unset)	Optional cookie domain scope
`Secure`	`true`	HTTPS-only
`HttpOnly`	`true` (forced)	Hidden from JavaScript
`SameSite`	`Lax`	`http.SameSite` value
`MaxAge`	`0` (session cookie)	Lifetime in seconds

Wiring cookies through securityhttp

The session cookie used by SessionAuthentication, login, and the synchronizer CSRF repository is configured through securityhttp.WithSessionStore, which takes a session.CookieConfig directly (not functional options):

securityhttp.New(
    securityhttp.WithSessionStore(store, users, session.CookieConfig{
        Name:     "MY_SESSION",
        Path:     "/",
        Secure:   true,
        SameSite: http.SameSiteLaxMode,
        MaxAge:   int((30 * time.Minute).Seconds()),
    }),
)

The CookieConfig argument is variadic and optional — omit it to use securityhttp’s secure cookie defaults.

Session fixation protection

session.FixationProtect(ctx, store, old) mints a new session, copies every attribute from old into it, deletes old, and returns the new session — migrating an attacker-fixated pre-login session id to a fresh one at the moment of authentication. SessionAuthentication (the middleware that resolves a session cookie into a core.Authentication on each request) does not call FixationProtect itself — it only re-authenticates from an already-established session. FixationProtect is invoked at the moment of authentication, by the login and credential-verification flows themselves:

web/auth/login.go (form login)
web/auth/mfa.go (MFA verification)
web/auth/passkey.go (passkey login)
web/auth/magiclink.go (magic-link login)
oauth2/callback.go (OAuth2/OIDC login)

Each of these calls session.FixationProtect(ctx, store, existingSession) on successful authentication so that a session id an attacker may have fixated before login can never be reused after login.

SQL store (separate module)

go get github.com/thuongh2/go-security/go-security-sql

import sqlsession "github.com/thuongh2/go-security/go-security-sql/session"

store, err := sqlsession.NewStore(db, sqlsession.Postgres{}, sqlsession.Options{
    EncryptionKey: myKey, // AES-256-GCM, 32 bytes — required unless AllowPlaintextAttributes
})

sqlsession.Postgres{}/sqlsession.MySQL{} are built in; pass your own type implementing sqlsession.Dialect for any other SQL flavor. See go-security-sql for the full interface, schema contract, and encryption details.

Redis store (separate module)

go get github.com/thuongh2/go-security-redis

import gosecurityredis "github.com/thuongh2/go-security-redis"

store := gosecurityredis.NewStore(redisClient, gosecurityredis.Options{
    KeyPrefix: "sess:",
    MaxAge:    30 * time.Minute,
})

The Redis store serializes sessions with encoding/gob. Register any custom types your session values use:

gob.Register(MyType{})

Foundation

Authentication

Authorization

Session & Cookies

OAuth2 & JWT

HTTP Layer

Resilience

Observability

Distributed Stores

Import

Store interface

MemoryStore

Options

Session interface

CookieConfig fields

Wiring cookies through securityhttp

Session fixation protection

SQL store (separate module)

Redis store (separate module)

​Import

​Store interface

​MemoryStore

​Options

​Session interface

​Cookie helpers

​CookieConfig fields

​Wiring cookies through securityhttp

​Session fixation protection

​SQL store (separate module)

​Redis store (separate module)

Import

Store interface

MemoryStore

Options

Session interface

Cookie helpers

CookieConfig fields

Wiring cookies through securityhttp

Session fixation protection

SQL store (separate module)

Redis store (separate module)