Go语言中的Session管理：构建Web应用的用户会话

go get github.com/gorilla/sessions
go get github.com/gorilla/mux

package main

import (
    "fmt"
    "log"
    "net/http"

    "github.com/gorilla/mux"
    "github.com/gorilla/sessions"
)

var (
    // 定义一个密钥，用于加密Session cookie。请务必使用随机生成的密钥。
    key   = []byte("super-secret-key")
    store = sessions.NewCookieStore(key)
)

func homeHandler(w http.ResponseWriter, r *http.Request) {
    // 获取session
    session, _ := store.Get(r, "session-name")

    // 设置session值
    session.Values["authenticated"] = true
    session.Values["username"] = "example_user"
    session.Save(r, w) // 保存session

    fmt.Fprintln(w, "Welcome to the home page!")
}

func profileHandler(w http.ResponseWriter, r *http.Request) {
    // 获取session
    session, _ := store.Get(r, "session-name")

    // 检查用户是否已认证
    if auth, ok := session.Values["authenticated"].(bool); !ok || !auth {
        http.Error(w, "Unauthorized", http.StatusUnauthorized)
        return
    }

    username := session.Values["username"].(string)
    fmt.Fprintf(w, "Welcome, %s!\n", username)
}

func logoutHandler(w http.ResponseWriter, r *http.Request) {
    // 获取session
    session, _ := store.Get(r, "session-name")

    // 清空session
    session.Options.MaxAge = -1 // 将 MaxAge 设置为 -1 会立即删除 cookie
    err := session.Save(r, w)
    if err != nil {
        http.Error(w, err.Error(), http.StatusInternalServerError)
        return
    }

    fmt.Fprintln(w, "Logged out successfully!")
}

func main() {
    router := mux.NewRouter()
    router.HandleFunc("/", homeHandler)
    router.HandleFunc("/profile", profileHandler)
    router.HandleFunc("/logout", logoutHandler)

    fmt.Println("Server listening on port 8080")
    log.Fatal(http.ListenAndServe(":8080", router))
}

package main

import (
    "fmt"
    "log"
    "net/http"
    "time"
)

const sessionCookieName = "my_session"

func setSession(w http.ResponseWriter, userID string) {
    // 创建一个cookie
    cookie := &http.Cookie{
        Name:     sessionCookieName,
        Value:    userID,
        Path:     "/", // 允许所有路径访问cookie
        Expires:  time.Now().Add(24 * time.Hour), // 设置cookie过期时间
        HttpOnly: true, // 阻止客户端脚本访问cookie，提高安全性
    }
    http.SetCookie(w, cookie)
}

func getSession(r *http.Request) (string, error) {
    // 获取cookie
    cookie, err := r.Cookie(sessionCookieName)
    if err != nil {
        return "", err
    }
    return cookie.Value, nil
}

func homeHandler(w http.ResponseWriter, r *http.Request) {
    // 模拟用户登录，设置session
    setSession(w, "user123")
    fmt.Fprintln(w, "Session set! Visit /profile to see it.")
}

func profileHandler(w http.ResponseWriter, r *http.Request) {
    // 获取session
    userID, err := getSession(r)
    if err != nil {
        http.Error(w, "No session found", http.StatusUnauthorized)
        return
    }

    fmt.Fprintf(w, "Welcome, user with ID: %s\n", userID)
}

func main() {
    http.HandleFunc("/", homeHandler)
    http.HandleFunc("/profile", profileHandler)

    fmt.Println("Server listening on port 8080")
    log.Fatal(http.ListenAndServe(":8080", nil))
}