Class: Gloo::WebSvr::Session

Inherits:
Object
  • Object
show all
Defined in:
lib/gloo/web_svr/session.rb

Constant Summary collapse

SESSION_CONTAINER = 
'session'.freeze
SESSION_ID_NAME = 
'session_id'.freeze

Instance Method Summary collapse

Constructor Details

#initialize(engine, server_obj) ⇒ Session

Set up the web server.



28
29
30
31
32
33
34
35
 
# File 'lib/gloo/web_svr/session.rb', line 28

def initialize( engine, server_obj )
  @engine = engine
  @log = @engine.log

  @server_obj = server_obj
  @include_in_response = false
  @clearing_session = false
end

Instance Method Details

#add_session_for_response(headers) ⇒ Object

If there is session data, encrypt and add it to the response. Once done, clear out the session data.



120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
 
# File 'lib/gloo/web_svr/session.rb', line 120

def add_session_for_response( headers )
  # Are we using sessions?
  if @server_obj.use_session? && @include_in_response
    # Reset the flag because we are adding to the session data now
    @include_in_response = false

    # Build and add encrypted session data
    data = @server_obj.get_session_data
    data[ SESSION_ID_NAME ] = get_session_id

    unless data.empty?
      data = encrypt_encode( data )
      session_hash = { 
        value: data, 
        path: cookie_path, 
        expires: cookie_expires,
        http_only: true }

      if secure_cookie?
        session_hash[ :secure ] = true
      end

      Rack::Utils.set_cookie_header!( headers, session_name, session_hash )
    end
  end

  return headers
end

#add_session_to_response ⇒ Object

Temporarily set the flag to add the session data to the response. Once this is done, the flag will be cleared and it will not be added to the next request unless specifically set.



82
83
84
 
# File 'lib/gloo/web_svr/session.rb', line 82

def add_session_to_response
  @include_in_response = true
end

#clear_session_data ⇒ Object

Clear out the session Id. Set the flag to add the session data to the response.



110
111
112
113
114
 
# File 'lib/gloo/web_svr/session.rb', line 110

def clear_session_data
  @session_id = nil
  @clearing_session = true
  add_session_to_response
end

#cookie_expires ⇒ Object

Get the expiration time for the session cookie.



202
203
204
 
# File 'lib/gloo/web_svr/session.rb', line 202

def cookie_expires
  return @server_obj.session_cookie_expires
end

#cookie_path ⇒ Object

Get the path for the session cookie.



195
196
197
 
# File 'lib/gloo/web_svr/session.rb', line 195

def cookie_path
  return @server_obj.session_cookie_path
end

#decode_decrypt(data) ⇒ Object

Decode and decrypt the session data.



164
165
166
167
168
169
 
# File 'lib/gloo/web_svr/session.rb', line 164

def decode_decrypt( data )
  return nil unless data && key && iv

  data = Gloo::Objs::Cipher.decrypt( data, key, iv )
  return JSON.parse( data )
end

#encrypt_encode(data) ⇒ Object

Encrypt and encode the session data.



157
158
159
 
# File 'lib/gloo/web_svr/session.rb', line 157

def encrypt_encode( data )
  return Gloo::Objs::Cipher.encrypt( data.to_json, key, iv )
end

#get_session_id ⇒ Object

Initialize the session id and add it to the data. Use the current session ID if it is there.



95
96
97
98
99
100
101
102
103
104
 
# File 'lib/gloo/web_svr/session.rb', line 95

def get_session_id
  if @clearing_session
    @clearing_session = false
    return nil
  end

  init_session_id if @session_id.blank?

  return @session_id
end

#init_session_id ⇒ Object 



86
87
88
89
 
# File 'lib/gloo/web_svr/session.rb', line 86

def init_session_id
  @session_id = Gloo::Objs::CsrfToken.generate_csrf_token
  return @session_id
end

#iv ⇒ Object

Get the initialization vector for the cipher.



188
189
190
 
# File 'lib/gloo/web_svr/session.rb', line 188

def iv
  return @server_obj.encryption_iv
end

#key ⇒ Object

Get the key for the encryption cipher.



181
182
183
 
# File 'lib/gloo/web_svr/session.rb', line 181

def key
  return @server_obj.encryption_key
end

#secure_cookie? ⇒ Boolean

Should the session cookie be secure?

Returns:

  • (Boolean) 


209
210
211
 
# File 'lib/gloo/web_svr/session.rb', line 209

def secure_cookie?
  return @server_obj.session_cookie_secure
end

#session_name ⇒ Object

Get the session cookie name.



174
175
176
 
# File 'lib/gloo/web_svr/session.rb', line 174

def session_name
  return @server_obj.session_name
end

#set_session_data_for_request(env) ⇒ Object

Get the session data from the encrypted cookie. Add it to the session container.



46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
 
# File 'lib/gloo/web_svr/session.rb', line 46

def set_session_data_for_request( env )
  begin
    cookie_hash = Rack::Utils.parse_cookies( env )

    # Are we using sessions?
    if @server_obj.use_session?
      data = cookie_hash[ session_name ]

      if data
        data = decode_decrypt( data ) 
        return unless data
        
        @session_id = data[ SESSION_ID_NAME ]

        data.each do |key, value|
          unless key == SESSION_ID_NAME
            @server_obj.set_session_var( key, value )
          end
        end
      end
    end
  rescue => e
    @engine.log_exception e
  end
end