利用Gorilla Sessions自定义后端实现高效会话管理

// Store represents a session store.
//
// See https://github.com/gorilla/sessions#store-interface
type Store interface {
    // Get returns a session for the given name and optionally a new session
    // if the current one is not yet registered.
    Get(r *http.Request, name string) (*Session, error)
    // New returns a new session for the given name without saving it.
    New(r *http.Request, name string) (*Session, error)
    // Save saves the given session, typically by adding a Set-Cookie header
    // to the response.
    Save(r *http.Request, w http.ResponseWriter, session *Session) error
}

package main

import (
    "encoding/gob"
    "fmt"
    "net/http"
    "time"

    "github.com/garyburd/redigo/redis"
    "github.com/gorilla/sessions"
)

// RedisStore represents a session store backed by Redis.
type RedisStore struct {
    pool    *redis.Pool
    keyPair *sessions.CookieStore // Used for encoding/decoding session values in cookies
}

// NewRedisStore creates a new RedisStore.
func NewRedisStore(pool *redis.Pool, keyPairs ...[]byte) *RedisStore {
    store := &RedisStore{
        pool:    pool,
        keyPair: sessions.NewCookieStore(keyPairs...),
    }
    // Register types that will be stored in sessions to gob
    gob.Register(map[string]interface{}{})
    return store
}

// Get returns a session for the given name and optionally a new session
// if the current one is not yet registered.
func (s *RedisStore) Get(r *http.Request, name string) (*sessions.Session, error) {
    return sessions.GetRegistry(r).Get(s, name)
}

// New returns a new session for the given name without saving it.
func (s *RedisStore) New(r *http.Request, name string) (*sessions.Session, error) {
    session := sessions.NewSession(s, name)
    session.Options = &sessions.Options{
        Path:     "/",
        MaxAge:   86400 * 7, // 7 days
        HttpOnly: true,
    }

    // Try to load session from Redis if a session ID cookie exists
    cookie, err := r.Cookie(name)
    if err == nil {
        // Attempt to decode the session ID from the cookie
        var sessionID string
        if err = s.keyPair.Decode(name, cookie.Value, &sessionID); err == nil {
            conn := s.pool.Get()
            defer conn.Close()

            // Retrieve session data from Redis using the session ID
            data, err := redis.Bytes(conn.Do("GET", "session:"+sessionID))
            if err == nil && len(data) > 0 {
                // Deserialize data into session.Values
                if err = gob.NewDecoder(bytes.NewBuffer(data)).Decode(&session.Values); err == nil {
                    session.ID = sessionID
                    session.IsNew = false
                }
            }
        }
    }
    return session, nil
}

// Save saves the given session, typically by adding a Set-Cookie header
// to the response.
func (s *RedisStore) Save(r *http.Request, w http.ResponseWriter, session *sessions.Session) error {
    if session.Options.MaxAge < 0 {
        // Delete session from Redis and cookie
        if session.ID != "" {
            conn := s.pool.Get()
            defer conn.Close()
            _, err := conn.Do("DEL", "session:"+session.ID)
            if err != nil {
                return err
            }
        }
        // Delete cookie
        session.Options.MaxAge = -1 // Mark for deletion
        return s.keyPair.Save(r, w, session)
    }

    if session.ID == "" {
        session.ID = generateSessionID() // Implement your own ID generation
    }

    // Serialize session.Values to bytes
    var buf bytes.Buffer
    if err := gob.NewEncoder(&buf).Encode(session.Values); err != nil {
        return err
    }

    conn := s.pool.Get()
    defer conn.Close()

    // Store session data in Redis
    _, err := conn.Do("SETEX", "session:"+session.ID, session.Options.MaxAge, buf.Bytes())
    if err != nil {
        return err
    }

    // Encode session ID into cookie
    encodedID, err := s.keyPair.Encode(session.Name(), session.ID)
    if err != nil {
        return err
    }

    // Set the session ID cookie
    http.SetCookie(w, sessions.NewCookie(session.Name(), encodedID, session.Options))

    return nil
}

// generateSessionID is a placeholder for actual session ID generation logic.
func generateSessionID() string {
    // In a real application, use a cryptographically secure random string.
    return fmt.Sprintf("%d-%d", time.Now().UnixNano(), rand.Intn(100000))
}

// Example usage:
func main() {
    // Initialize Redis pool
    pool := &redis.Pool{
        MaxIdle:     3,
        IdleTimeout: 240 * time.Second,
        Dial: func() (redis.Conn, error) {
            c, err := redis.Dial("tcp", ":6379")
            if err != nil {
                return nil, err
            }
            return c, err
        },
    }
    defer pool.Close()

    // Create RedisStore with authentication keys
    store := NewRedisStore(pool,
        []byte("super-secret-auth-key"), // Authentication key
        []byte("super-secret-enc-key"),  // Encryption key
    )

    http.HandleFunc("/", func(w http.ResponseWriter, r *http.Request) {
        session, err := store.Get(r, "my-session")
        if err != nil {
            http.Error(w, err.Error(), http.StatusInternalServerError)
            return
        }

        // Set some session values
        if session.Values["foo"] == nil {
            session.Values["foo"] = 0
        }
        session.Values["foo"] = session.Values["foo"].(int) + 1
        session.Values["bar"] = "baz"

        err = session.Save(r, w)
        if err != nil {
            http.Error(w, err.Error(), http.StatusInternalServerError)
            return
        }

        fmt.Fprintf(w, "Hello, session! Foo: %v", session.Values["foo"])
    })

    fmt.Println("Server listening on :8080")
    http.ListenAndServe(":8080", nil)
}