Session

The GoFrame framework provides comprehensive Session management capabilities, implemented by the gsession component. Since the Session mechanism is most commonly used in HTTP services, the subsequent chapters will focus on the use of Session in the context of HTTP services.

Introduction

API Documentation: https://pkg.go.dev/github.com/gogf/gf/v2/os/gsession

You can obtain a Session object at any time through ghttp.Request since both Cookie and Session are related to request sessions and thus are part of the Request member objects and are publicly accessible. The default expiration time for Session in the GoFrame framework is 24 hours.

The SessionId is transmitted by default through Cookie, but it also supports transmission via Header from the client. The identification name of SessionId can be modified through the SetSessionIdName of ghttp.Server. The operations of Session are concurrency-safe, which is why the framework does not operate data directly in a map form in its Session design. During the HTTP request flow, we can obtain the Session object through the ghttp.Request object and perform the corresponding data operations.

In addition, the SessionId in ghttp.Server is generated using the client‘s RemoteAddr + Header request information via the guid module, ensuring randomness and uniqueness: https://github.com/gogf/gf/blob/master/net/ghttp/ghttp_request.go

gsession Module

The management functionality of Session is implemented by the independent gsession module and is perfectly integrated into ghttp.Server. Since this module is decoupled and independent, it can be applied to more different scenarios, such as TCP communication, gRPC API services, etc. The gsession module has three important objects/APIs:

  1. gsession.Manager: Manages Session objects, Storage persistence storage objects, and expiration time control.
  2. gsession.Session: A single Session management object, used for CRUD operations on Session parameters and other data management operations.
  3. gsession.Storage: This is an API definition used for the persistent storage of Session objects, data writing/reading, and survival updates. Developers can implement customized persistent storage features based on this API. For the API definition, see: https://github.com/gogf/gf/blob/master/os/gsession/gsession_storage.go

Storage Implementations

gsession implements and provides developers with four common Session storage implementations:

Storage Distributed Support Persistence Support Memory Usage Execution Efficiency Brief Introduction
StorageFile No Yes Medium Medium Based on file storage (default). A more efficient persistent storage method under single-node deployment: Session - File
StorageMemory No No High High Based on pure memory storage. Single-node deployment, highest performance, but cannot be persisted, and is lost on restart: Session - Memory
StorageRedis Yes Yes Medium Medium Based on Redis storage (Key-Value). Remote Redis node stores Session data, supporting multi-node deployment: Session - Redis-KeyValue
StorageRedisHashTable Yes Yes Low Low Based on Redis storage (HashTable). Remote Redis node stores Session data, supporting multi-node deployment: Session - Redis-HashTable

Each method has its advantages and disadvantages. For detailed introductions, please refer to the corresponding sections.

Initialization of Session

Taking a common HTTP request as an example, the Session object in ghttp.Request adopts a “Lazy Initialization ” design approach. By default, there is a Session property object in the Request, but it is not initialized (an empty object). The initialization is only executed when methods of the Session property object are used. This design ensures that the execution performance of requests not utilizing the Session feature is maintained, while also ensuring the ease of use of the component.

Destruction/Logout of Session

When a user‘s Session is no longer needed, for instance, when a user logs out, the session needs to be hard-deleted from storage. This can be done by calling the RemoveAll method.

Documentation

📄️ Session - FileUsing the ghttp.Server of the GoFrame framework to implement file storage for sessions. By default, session storage uses a combination of memory and files through StorageFile for persistent management. Thanks to the gcache module, session data operations are efficient, especially suitable for scenarios with more reads and fewer writes. Meanwhile, the demonstration example shows how to set and get sessions in a GoFrame project.

📄️ Session - MemoryUse memory storage to implement Session functionality in the GoFrame framework. Memory storage is simple and efficient, but does not support persistence, so Session data will be lost after the application restarts. Through example code, it is explained in detail how to set the expiration time of the Session and how to store and retrieve Session data.

📄️ Session - Redis-KeyValueUsing Redis in the GoFrame framework for Session KeyValue storage to solve the issue of Session sharing across multiple nodes. By using the StorageRedis object to implement Redis storage, it improves execution efficiency, suitable for scenarios with small amounts of user Session data, and provides specific examples and explanations. In the example, the Session expiration time is set to 1 minute, demonstrating methods of setting, getting, deleting Sessions, and the recovery function of Session data in Redis.

📄️ Session - Redis-HashTableIn the GoFrame framework, use RedisHashTableStorage for session management. Unlike RedisKeyValueStorage, this method operates directly through the Redis service without needing a full data fetch. The example code illustrates basic session setting, retrieval, and deletion operations, and how to integrate this feature in GoFrame.

📄️ Session - Storage InterfaceDeveloping Session-Storage interfaces using the gsession component in the GoFrame framework. The built-in Storage implementation within the component can meet the needs of most business scenarios. Developers can also customize session storage according to specific cases. The article describes in detail the definition of the Storage interface and its invocation timing. To improve session performance, it is recommended to use the gmap container type. This guide will help developers better implement and optimize storage interfaces.

📄️ Session - RegenerateIdSession ID regeneration functionality in the GoFrame framework, preventing session fixation attacks through RegenerateId and MustRegenerateId methods to enhance web application security. Detailed explanation of session fixation attack principles, risks, and prevention methods, with complete code examples and security recommendations.