class Athena::HTTPKernel::Listeners::Session
inherits Reference
#
Sets the AHTTP::Session of each request, which is only created once it is first used, and persists it once the response is ready.
The session is identified by the request's session cookie. The cookie is set on the response when the session gets a new ID, and removed once the session is emptied, e.g. when logging out.
A response to a request that used the session, or that sets or clears its cookie, is marked as private and must be revalidated, as it may contain data specific to the client.
Set the NO_AUTO_CACHE_CONTROL_HEADER header on the response to opt out of this, e.g. if caching responses with session data makes sense.
Using the session while handling a request whose route is declared stateless logs a warning,
or raises an AHK::Exception::UnexpectedSessionUsage in debug mode.
Constants#
NO_AUTO_CACHE_CONTROL_HEADER = "athena-session-no-auto-cache-control"#
Disables marking the response as private if its request used the session. The header itself is removed from the response.
Constructors#
.new(session_factory : AHTTP::Session::Factory, debug : Bool = false, cookie_path : String = "/", cookie_domain : String | Nil = nil, cookie_secure : Bool | Nil = nil, cookie_http_only : Bool = true, cookie_samesite : ::HTTP::Cookie::SameSite | Nil = :lax)#
Creates a listener using the provided session_factory to create the session of each request.
The cookie_path, cookie_domain, cookie_secure, cookie_http_only, and cookie_samesite are the attributes of the session cookie.
A cookie_secure of nil only marks the cookie as secure if the request was made over HTTPS.
The cookie expires once the session's lifetime has passed, if it has one.
Methods#
#on_response(event : AHK::Events::Response) : Nil#
Runs after other response listeners, so that they can still use the session.