Ability to store session client-side about vertx-web HOT 4 CLOSED

Yes, seems like a good idea. Go for it :)

from vertx-web.

After some investigation client sessions are tricky to implement due to the fact that the store needs to access the context both to load the session cookie to the session object and to serialize back the session object to the cookie at the end of the request.

In order to keep the API simple and minimal we might need to refactor the session store interface otherwise we need to duplicate the cookie handler and session handler code.

from vertx-web.

Storing the sessionData on a cookie is the same as using just a Cookie. Assume the following scenario: you have a webshop application and user {userId: 1} adds a book to the basket, you would then do: session.put('basket', [ 'item1' ]) and you expect that at the end of the request a cookie is sent to the client with: {userId: 1, basket: [ 'item1' ]}, so what is the role of the session store?

To me it seems that this is exactly the same as:

context.response().addCookie(Cookie.create('session', 
  JSON.stringify({userId: 1, basket: [ 'item1' ]}))

Now if you do this, then you can totally skip the server side and add items to your session at the client side since clients can read and write cookies (is this is configured to be allowed).

So from the the server side all you need in fact is to read the cookie which is trivial:

context.getCookie('session').getValue()

In reply to your other comment about security, well if you're sending all your session data in a cookie then there is always a chance that it will expose private information, if you want to encrypt the data, that is also simple, starting from the example above:

context.response().addCookie(
  Cookie.create('session',
    someEncryptionFunction(JSON.stringify({userId: 1, basket: [ 'item1' ]})))

you just need to implement your encryption function with your preferred algorithm.

I don't think we should refactor the current API just to implement a NO-OP store @stephane-bastian WDYT?

from vertx-web.

Since there is no feedback on this issue I'll close it for now and it can be re-open if there is interest.

from vertx-web.