What's the cookie_value in Session using for ?

[chenaoxd]

Why the cookie_value is not cloned or serialized, I can't get the point of doing this. Can someone explain why we should have this field, and make it not cloned or serialized. Thanks a lot. 😂

[jbr]

cookie value is what is stored in the cookie, which may be either a unique identifier or the full encrypted value of the cookie, depending on the session store's implementation. https://docs.rs/async-session/3.0.0/async_session/struct.Session.html#cloning-and-serialization It is removed on clone in order to keep from accidentally persisting it in the session, and the only way to retrieve the cookie value is to consume the session, ensuring that this is only done by the framework that owns the "original" (pre-clone) session that was either retrieved from a session store or created for the current request. For datastore-based session stores (everything except the cookie store), we do not store the cookie value anywhere, and the lookup key is a sha256 hash of that cookie value (https://docs.rs/tide/0.16.0/tide/sessions/index.html#if-no-cookie-is-found). This ensure that if anyone had read access to the session store database (or a snapshot of it), they would not be able to generate a cookie. There is exactly one copy of the cookie value, and it is no longer available anywhere server-side once the set-cookie header has been assigned. It is temporarily available in memory when the user makes a request, but is not retained.

---

Are you writing a framework implementation of async-session, a session store, or using async-session with an existing framework implementation? The cookie value should not be available to framework users.

[chenaoxd]

Yeah, I'm implementing my own postgresql session store because I'm currently using diesel instead of sqlx, so I want to prevent introducing a new db lib. And I'm integrating it into axum.

I found this because the cookie_value will not be set if only deserialized from previously-stored JSON (and by reading the code). Then I think I should use the set_cookie_value to set the cookie_value by myself after retrieving it from the database? 🤔

[jbr]

If you want a security review, please open an issue here once it's open source. You may want to reference the warp or tide implementations for comparison. You should not need to set cookie value ever

[chenaoxd]

Thanks again, I'll reference the tide implementations😄 .