2. Handling HTTP Requests with Gin – Session Management

2.10 Session

2.10.1 Definition of Session

    A Session is a series of requests and operations processed by the program during the interaction between the user and the server, where the program maintains state information about user activities. For example, this includes the user’s identity, preferences, and current session data. Typically, a session begins when a user logs in or accesses a website and lasts until the user logs out or terminates the session. During the session, users can interact with multiple pages in the program while maintaining state information across these interactions.

    Sessions are crucial for maintaining security and privacy, as they allow the program to verify user identity and restrict access to sensitive information. Additionally, they provide a personalized user experience by remembering user preferences and history. When a user first accesses a web application, a session is usually created, and a Session ID is assigned. This ID is typically stored in the user’s browser as a cookie or passed between clients via URL parameters. Its main functions are as follows:

• Maintain user login status: Users can remain logged in when they leave the application and return later.
• Provide a personalized experience: Display relevant content or information based on the user’s previous interaction preferences.

If session management is not handled properly, it can pose security risks. For instance, if the Session ID is not random enough or is obtained by an attacker, they may hijack the session and gain access to user data or operations. Therefore, it is essential to use secure Session IDs and expire them after a certain period.

2.10.2 Managing Sessions

2.10.2.1 Overview of gin-contrib/sessions Package

    The gin-contrib/sessions is a Go language package that provides session management middleware for web applications based on the Gin framework. It allows developers to easily implement server-side sessions in web applications to store and retrieve user-specific data across multiple requests. The package manages sessions by storing a unique Session ID in a cookie on the client side, while the server-side session data is stored in key-value pairs. It also provides middleware functionality to retrieve and store session data in the request context and handle session expiration and renewal.

    Using the gin-contrib/sessions package, various session-based functionalities can be implemented in web applications, such as user authentication, authorization, and user activity tracking. The package also supports various security features, including session encryption, secure cookie handling, and protection against session attacks. It consists of the following components:

• Middleware: The core functionality of the package, used to add session support to web applications based on the Gin framework. The User() method can be used to add the middleware to the Gin router, responsible for initializing and managing sessions for each request.
• Storage: Session data is stored on the server, and the gin-contrib/sessions package provides various backend storage options to save session data, such as memory storage, cookie-based storage, database storage, etc.
• Encoder/Decoder: Responsible for encoding and decoding session data in the backend storage to ensure the security of session data. The default encoder/decoder is based on Base64 encoding, but developers can also customize their own encoder/decoder.

2.10.2.2 Operations with gin-contrib/sessions Package

1. Installing gin-contrib/sessions

    The installation command is as follows:

go get -u github.com/gin-contrib/sessions

2. Using gin-contrib/sessions

    Example code is as follows:

• Setting a single session

package main

import (
    "net/http"
    "github.com/gin-contrib/sessions"
    "github.com/gin-contrib/sessions/cookie"
    "github.com/gin-gonic/gin"
)

// Set and save session
func SetSession(ctx *gin.Context) {
    session := sessions.Default(ctx)
    if session.Get("userId") != 123 {
        session.Set("userId", 123)
        session.Save()
    }
    ctx.JSON(http.StatusOK, gin.H{"status_code": http.StatusOK, "message": "set session success"})
}

func main() {
    // Initialize router
    r := gin.Default()
    // Set session storage and encrypt session with secret
    store := cookie.NewStore([]byte("secret"))
    // Use middleware
    r.Use(sessions.Sessions("session-sample", store))
    // Set route
    r.GET("/set-session", SetSession)
    r.Run()
}

• Setting multiple sessions

package main

import (
    "net/http"
    "github.com/gin-contrib/sessions"
    "github.com/gin-contrib/sessions/cookie"
    "github.com/gin-gonic/gin"
)

// Set and save multiple sessions
func SetManySession(ctx *gin.Context) {
    sessionA := sessions.DefaultMany(ctx, "session-a")
    sessionB := sessions.DefaultMany(ctx, "session-b")

    if sessionA.Get("userId") != 123 {
        sessionA.Set("userId", 123)
        sessionA.Save()
    }
    if sessionB.Get("name") != "surpass" {
        sessionB.Set("name", "surpass")
        sessionB.Save()
    }

    ctx.JSON(http.StatusOK, gin.H{"status_code": http.StatusOK, "message": gin.H{
        "session-a": sessionA.Get("userId"),
        "session-b": sessionB.Get("name"),
    }})
}

func main() {
    // Initialize router
    r := gin.Default()
    // Set session storage and encrypt session with secret
    store := cookie.NewStore([]byte("secret"))
    sessionNames := []string{"session-a", "session-b"}
    // Use middleware
    r.Use(sessions.SessionsMany(sessionNames, store))
    // Set route
    r.GET("/set-many-session", SetManySession)
    r.Run()
}

The above session usage is only applicable to a single interface; when multiple interfaces can be used simultaneously, the Group functionality in Gin can be utilized.

    The gin-contrib/sessions package can manage sessions with various backends such as Redis, Memcached, MongoDB, GORM, PostgreSQL, etc. For more information, please refer to the official GitHub: https://github.com/gin-contrib/sessions