ushka.http.sessions
This module provides the Session class, a secure client-side session manager
for the Ushka framework.
It implements HMAC-SHA256 for data integrity and timestamp-based validation to prevent replay attacks, ensuring that session data stored in cookies is tamper-proof and has a defined lifespan.
class Session(dict)
Secure Client-Side Session (HMAC-SHA256) with Timestamp.
This class extends dict to provide a secure, client-side session mechanism.
It uses HMAC-SHA256 for data integrity and includes a timestamp to prevent
replay attacks and enforce session expiration.
Parameters
secret_key | str | A strong, random secret key used for signing the session data. Essential for security. |
raw_cookie_value | str | The raw value of the session cookie received from the client.
If provided, the session data will be decoded and validated from this.
Defaults to |
max_age | int | The maximum age of the session in seconds. After this period, the session is considered expired. Defaults to 1209600 (14 days). |
secure | bool | If |
samesite | str | The |
__init__(self, secret_key: str, raw_cookie_value: str | None = None, max_age: int = 1209600, secure: bool = True, samesite: str = 'lax')
Initializes a new Session instance.
Parameters
secret_key | str | A strong, random secret key used for signing the session data. |
raw_cookie_value | str | The raw value of the session cookie received from the client. |
max_age | int | The maximum age of the session in seconds. Defaults to 14 days. |
secure | bool | If |
samesite | str | The |
clear(self) -> None
Removes all items from the session and marks it as modified.
pop(self, key: Any, default: Any = None) -> Any
Removes the specified key from the session and returns its value.
Marks the session as modified if the key existed.
Parameters
key | Any | The key of the item to remove. |
default | Any | The value to return if the key is not found. Defaults to |
Returns
Any | The value associated with the key, or |
update(self, *args, **kwargs) -> None
Updates the session with key-value pairs from another dictionary or iterable.
Marks the session as modified if any updates occur.
Parameters
*args | Positional arguments passed to the underlying | |
**kwargs | Keyword arguments passed to the underlying |
setdefault(self, key: Any, default: Any = None) -> Any
Inserts a key with a default value if the key is not already in the session.
Marks the session as modified if the key is newly inserted.
Parameters
key | Any | The key to check and potentially insert. |
default | Any | The value to insert if the key is not found. Defaults to |
Returns
Any | The value for the key (either existing or newly inserted). |
get_response_headers(self) -> List[Tuple[bytes, bytes]]
Generates the Set-Cookie header ready for the WSGI/ASGI server.