优化Golang Gorilla/session：理解与正确配置会话过期策略

package main

import (
    "fmt"
    "log"
    "net/http"
    "time"

    "github.com/gorilla/sessions"
)

var store *sessions.CookieStore

func init() {
    // 初始化会话存储，这里使用一个随机密钥
    authKey := []byte("super-secret-auth-key")
    encryptionKey := []byte("super-secret-encryption-key")
    store = sessions.NewCookieStore(authKey, encryptionKey)
    // 注意：这里没有全局设置MaxAge
}

func initSession(r *http.Request) *sessions.Session {
    session, err := store.Get(r, "mySessionStore")
    if err != nil {
        log.Printf("Error getting session: %v", err)
        // 根据实际情况处理错误，例如返回一个空的会话或重定向
        return sessions.NewSession(store, "mySessionStore") // 返回一个新会话以避免nil
    }

    if session.IsNew {
        session.Options.Domain = "localhost"
        session.Options.MaxAge = 10 // 首次创建时设置为10秒
        session.Options.HttpOnly = true
        session.Options.Secure = false // 示例，生产环境应为true
        log.Println("Create New Session (cookie) with MaxAge=10s")
    } else {
        log.Println("Use Old Session (old cookie)")
        // 注意：这里没有重新设置 session.Options.MaxAge
    }
    return session
}

func handler(w http.ResponseWriter, r *http.Request) {
    session := initSession(r)

    // 模拟一些会话数据的存储
    session.Values["foo"] = "bar"
    session.Values["time"] = time.Now().Format(time.RFC3339)

    // 保存会话
    if err := session.Save(r, w); err != nil {
        http.Error(w, fmt.Sprintf("Error saving session: %v", err), http.StatusInternalServerError)
        return
    }

    fmt.Fprintf(w, "Session handled. IsNew: %t, MaxAge set to 10s on new. Check browser cookies.", session.IsNew)
}

func main() {
    http.HandleFunc("/", handler)
    log.Println("Server started on :8080")
    log.Fatal(http.ListenAndServe(":8080", nil))
}

package main

import (
    "fmt"
    "log"
    "net/http"
    "time"

    "github.com/gorilla/sessions"
)

var store *sessions.CookieStore

func init() {
    authKey := []byte("super-secret-auth-key")
    encryptionKey := []byte("super-secret-encryption-key")
    store = sessions.NewCookieStore(authKey, encryptionKey)

    // 推荐：在初始化CookieStore时设置全局的会话选项
    store.Options = &sessions.Options{
        Path:     "/",
        Domain:   "localhost", // 生产环境应设置为你的域名
        MaxAge:   60 * 60 * 24, // 设置为1天 (24小时)
        HttpOnly: true,
        Secure:   false, // 生产环境应设置为true
        SameSite: http.SameSiteLaxMode,
    }
    log.Println("Session store initialized with global MaxAge=1 day")
}

func getSession(r *http.Request) (*sessions.Session, error) {
    session, err := store.Get(r, "mySessionStore")
    if err != nil {
        // 错误处理：如果会话存储损坏或用户禁用cookie，Get可能会返回错误
        // 此时可以根据业务逻辑决定是返回新会话、重定向到登录页还是报错
        log.Printf("Error getting session: %v", err)
        // 示例：返回一个空的、尚未保存的新会话
        return sessions.NewSession(store, "mySessionStore"), err
    }
    return session, nil
}

func handler(w http.ResponseWriter, r *http.Request) {
    session, err := getSession(r)
    if err != nil {
        // 如果getSession返回错误，并且我们选择不继续处理
        http.Error(w, fmt.Sprintf("Failed to retrieve session: %v", err), http.StatusInternalServerError)
        return
    }

    if session.IsNew {
        log.Println("New Session created. MaxAge will be from store.Options.")
    } else {
        log.Println("Existing Session used. MaxAge will be from store.Options (or previous cookie if not saved).")
    }

    session.Values["last_visit"] = time.Now().Format(time.RFC3339)

    // 保存会话。此时，如果会话是新的，或者之前没有保存过Options，
    // 并且你没有在session.Options中设置其他值，
    // 它将继承store.Options中的MaxAge。
    if err := session.Save(r, w); err != nil {
        http.Error(w, fmt.Sprintf("Error saving session: %v", err), http.StatusInternalServerError)
        return
    }

    fmt.Fprintf(w, "Session handled. IsNew: %t, MaxAge configured globally in store. Check browser cookies.", session.IsNew)
}

func main() {
    http.HandleFunc("/", handler)
    log.Println("Server started on :8080")
    log.Fatal(http.ListenAndServe(":8080", nil))
}