diff --git a/sessions/config.go b/sessions/config.go index 37d94ca9..ecfd99a6 100644 --- a/sessions/config.go +++ b/sessions/config.go @@ -58,7 +58,8 @@ type ( // AllowReclaim will allow to // Destroy and Start a session in the same request handler. - // All it does is that it removes the cookie for both `Request` and `ResponseWriter`. + // All it does is that it removes the cookie for both `Request` and `ResponseWriter` while `Destroy` + // or add a new cookie to `Request` while `Start`. // // Defaults to false. AllowReclaim bool diff --git a/sessions/cookie.go b/sessions/cookie.go index b4698b39..537f8d19 100644 --- a/sessions/cookie.go +++ b/sessions/cookie.go @@ -31,9 +31,11 @@ func GetCookie(ctx context.Context, name string) string { } // AddCookie adds a cookie -func AddCookie(ctx context.Context, cookie *http.Cookie) { +func AddCookie(ctx context.Context, cookie *http.Cookie, reclaim bool) { // http.SetCookie(ctx.ResponseWriter(), cookie) - // ctx.Request().AddCookie(cookie) + if reclaim { + ctx.Request().AddCookie(cookie) + } ctx.SetCookie(cookie) } @@ -50,7 +52,7 @@ func RemoveCookie(ctx context.Context, name string, purge bool) { c.MaxAge = -1 c.Value = "" c.Path = "/" - AddCookie(ctx, c) + AddCookie(ctx, c, purge) if purge { // delete request's cookie also, which is temporary available. diff --git a/sessions/sessions.go b/sessions/sessions.go index 3a45e26a..e4025f84 100644 --- a/sessions/sessions.go +++ b/sessions/sessions.go @@ -96,7 +96,7 @@ func (s *Sessions) updateCookie(ctx context.Context, sid string, expires time.Du // encode the session id cookie client value right before send it. cookie.Value = s.encodeCookieValue(cookie.Value) - AddCookie(ctx, cookie) + AddCookie(ctx, cookie, s.config.AllowReclaim) } // Start should start the session for the particular request. @@ -131,7 +131,8 @@ func (s *Sessions) UpdateExpiration(ctx context.Context, expires time.Duration) cookieValue := s.decodeCookieValue(GetCookie(ctx, s.config.Cookie)) if cookieValue != "" { - if s.provider.UpdateExpiration(cookieValue, expires) { + // we should also allow it to expire when the browser closed + if s.provider.UpdateExpiration(cookieValue, expires) || expires == -1 { s.updateCookie(ctx, cookieValue, expires) } }