search

xitrum-framework / xitrum

Async and clustered Scala web framework and HTTP(S) server
http://xitrum-framework.github.io/
MIT License
446 stars 52 forks source link

Explicitly provide no session #678

Closed Ellzord closed 5 years ago

Ellzord commented 5 years ago

We would like to explicitly ensure that a session is not retrieved or stored.

We use filters and store data on session (for authentication and application state) but do not always have recipients that use sessions. We would not want to hit max user sessions in hazelcast and have our session users logged out because we've had too many users that dont make use of the sessions. We're storing data in hazelcast unnecessarily as they never return with the same session.

gbenbow commented 5 years ago

+1

ngocdaothanh commented 5 years ago

@Ellzord

Thanks for the PR. I'd like to understand your situation a little more.

Instead of session, is it possible for you to use at or RequestVar, as explained in Xitrum Guide? https://xitrum-framework.github.io/guide/3.28/html/en/scopes.html

Ellzord commented 5 years ago

@ngocdaothanh Yes I do want to use at. For any others wondering you can check if the request has a session token using requestCookies.isDefinedAt(Config.xitrum.session.cookieName) before attempting to check the session.

I could see some usefulness with creating isSessionTokenProvided in SessionEnv. You could then re-use this in your CookieSessionStore.