Sessions

This example will show how to store data in session cookies using the popular gorilla/sessions package in Go.

Cookies are small pieces of data stored in the browser of a user and are sent to our server on each request. In them, we can store e.g. whether or not a user is logged in into our website and figure out who he actually is (in our system).

In this example we will only allow authenticated users to view our secret message on the /secret page. To get access to it, the will first have to visit /login to get a valid session cookie, which logs him in. Additionally he can visit /logout to revoke his access to our secret message.

  1. // sessions.go
  2. package main
  4. import (
  5.     "fmt"
  6.     "net/http"
  8.     "github.com/gorilla/sessions"
  9. )
  11. var (
  12.     // key must be 16, 24 or 32 bytes long (AES-128, AES-192 or AES-256)
  13.     key = []byte("super-secret-key")
  14.     store = sessions.NewCookieStore(key)
  15. )
  17. func secret(w http.ResponseWriter, r *http.Request) {
  18.     session, _ := store.Get(r, "cookie-name")
  20.     // Check if user is authenticated
  21.     if auth, ok := session.Values["authenticated"].(bool); !ok || !auth {
  22.         http.Error(w, "Forbidden", http.StatusForbidden)
  23.         return
  24.     }
  26.     // Print secret message
  27.     fmt.Fprintln(w, "The cake is a lie!")
  28. }
  30. func login(w http.ResponseWriter, r *http.Request) {
  31.     session, _ := store.Get(r, "cookie-name")
  33.     // Authentication goes here
  34.     // ...
  36.     // Set user as authenticated
  37.     session.Values["authenticated"] = true
  38.     session.Save(r, w)
  39. }
  41. func logout(w http.ResponseWriter, r *http.Request) {
  42.     session, _ := store.Get(r, "cookie-name")
  44.     // Revoke users authentication
  45.     session.Values["authenticated"] = false
  46.     session.Save(r, w)
  47. }
  49. func main() {
  50.     http.HandleFunc("/secret", secret)
  51.     http.HandleFunc("/login", login)
  52.     http.HandleFunc("/logout", logout)
  54.     http.ListenAndServe(":8080", nil)
  55. }
  1. $ go run sessions.go
  3. $ curl -s http://localhost:8080/secret
  4. Forbidden
  6. $ curl -s -I http://localhost:8080/login
  7. Set-Cookie: cookie-name=MTQ4NzE5Mz...
  9. $ curl -s --cookie "cookie-name=MTQ4NzE5Mz..." http://localhost:8080/secret
  10. The cake is a lie!