Managing User Sessions with Cookies

Introduction to User Sessions with Cookies

Welcome back! Building on the previous lesson, where we focused on JWT authentication for securing API endpoints, this lesson will emphasize managing user sessions through cookies. By using cookies, web applications can maintain a user's authenticated state across multiple HTTP requests, enhancing the user experience. We will explore how to manage user sessions securely using cookies in the Gin framework. This lesson will guide you through creating and verifying sessions, leveraging cookies to store JWTs securely.

Understanding Cookies

Cookies are small data pieces sent from a website and stored on the user's device by the user's web browser. They act as a memory for web applications, allowing the server to recognize returning users and maintain state—such as login status—across otherwise stateless HTTP requests. Without cookies, each HTTP request would be like meeting a stranger every time; cookies let the server "remember" who you are between requests. In this lesson, you'll learn how to effectively utilize cookies to maintain user sessions, especially in stateless HTTP applications that use JWT for authentication Cookies allow us to store JWTs on the client side, and these can be sent back with every request to facilitate smooth session management. By storing JWTs in cookies, we ensure that user's authenticated state persists across different requests. Let's consider a simple example where we set a cookie using the Gin c.SetCookie method: Gofunc ExampleSetCookie(c *gin.Context) { c.SetCookie( "example_cookie", // Cookie name "cookie_value", // Cookie value 3600, // MaxAge in seconds (1 hour) "/", // Path "localhost", // Domain false, // Secure - HTTPS only true, // HttpOnly - JavaScript access ) c.JSON(http.StatusOK, gin.H{"message": "Cookie has been set"}) } In this example, we are setting a cookie named example_cookie with a value of cookie_value. The cookie will last for 1 hour (3600 seconds), applying it to the root path /, and be sent only to the localhost domain. Please note that using localhost as the domain will limit the functionality to local development environment; for deployment in production or more general environments, you should use a domain that matches your application's host domain. Finally, the cookie is marked as not secure (HTTP allowed) but is HttpOnly, meaning it cannot be accessed via JavaScript, which helps in mitigating XSS attacks. This function returns a JSON response once the cookie is set.

Join the 1M+ learners on CodeSignal

Be a part of our community of 1M+ users who develop and demonstrate their skills on CodeSignal

Implementing Login Functionality with Session Management

Let's delve into implementing login functionality coupled with session management.

controllers package:

package controllers

import (
    "net/http"
    "time"

    "github.com/gin-gonic/gin"
    "gorm.io/gorm"

    "codesignal.com/todoapp/services"
)

func LoginWithSession(c *gin.Context, db *gorm.DB) {
    var credentials struct {
        Username string `json:"username"`
        Password string `json:"password"`
    }
    if err := c.ShouldBindJSON(&credentials); err != nil {
        c.JSON(http.StatusBadRequest, gin.H{"error": "Invalid JSON"})
        return
    }
    
    // Check user's credentials
    if err := services.LoginUser(db, credentials.Username, credentials.Password); err != nil {
        c.JSON(http.StatusUnauthorized, gin.H{"error": "Invalid credentials"})
        return
    }
    
    // Generate JWT
    tokenString, err := services.GenerateToken(credentials.Username)
    if err != nil {
        c.JSON(http.StatusInternalServerError, gin.H{"error": "Could not generate token"})
        return
    }

    // Sets a cookie named "session_token" with the JWT as the value and with 4 hours validity
    c.SetCookie("session_token", tokenString, int(4*time.Hour), "/", "localhost", false, true)
    c.JSON(http.StatusOK, gin.H{"message": "Login successful, session created"})
}

package controllers

import (
    "net/http"
    "time"

    "github.com/gin-gonic/gin"
    "gorm.io/gorm"

    "codesignal.com/todoapp/services"
)

func LoginWithSession(c *gin.Context, db *gorm.DB) {
    var credentials struct {
        Username string `json:"username"`
        Password string `json:"password"`
    }
    if err := c.ShouldBindJSON(&credentials); err != nil {
        c.JSON(http.StatusBadRequest, gin.H{"error": "Invalid JSON"})
        return
    }
    
    // Check user's credentials
    if err := services.LoginUser(db, credentials.Username, credentials.Password); err != nil {
        c.JSON(http.StatusUnauthorized, gin.H{"error": "Invalid credentials"})
        return
    }
    
    // Generate JWT
    tokenString, err := services.GenerateToken(credentials.Username)
    if err != nil {
        c.JSON(http.StatusInternalServerError, gin.H{"error": "Could not generate token"})
        return
    }

    // Sets a cookie named "session_token" with the JWT as the value and with 4 hours validity
    c.SetCookie("session_token", tokenString, int(4*time.Hour), "/", "localhost", false, true)
    c.JSON(http.StatusOK, gin.H{"message": "Login successful, session created"})
}

services package:

package services

import (
    "time"

    "github.com/golang-jwt/jwt/v5"
    "gorm.io/gorm"

    "codesignal.com/todoapp/repositories/user_repository"
)

var jwtSecret = []byte("your_jwt_secret_key")

type Claims struct {
    Username string `json:"username"`
    jwt.RegisteredClaims
}

func GenerateToken(username string) (string, error) {
    // Generate JWT with 4 hours expiration time
    expirationTime := time.Now().Add(4 * time.Hour)
    claims := &Claims{
        Username: username,
        RegisteredClaims: jwt.RegisteredClaims{
            ExpiresAt: jwt.NewNumericDate(expirationTime),
        },
    }
    token := jwt.NewWithClaims(jwt.SigningMethodHS256, claims)
    return token.SignedString(jwtSecret)
}

func LoginUser(db *gorm.DB, username, password string) error {
    // Check if credentials match in the database
    return user_repository.ValidateUser(db, username, password)
}

package services

import (
    "time"

    "github.com/golang-jwt/jwt/v5"
    "gorm.io/gorm"

    "codesignal.com/todoapp/repositories/user_repository"
)

var jwtSecret = []byte("your_jwt_secret_key")

type Claims struct {
    Username string `json:"username"`
    jwt.RegisteredClaims
}

func GenerateToken(username string) (string, error) {
    // Generate JWT with 4 hours expiration time
    expirationTime := time.Now().Add(4 * time.Hour)
    claims := &Claims{
        Username: username,
        RegisteredClaims: jwt.RegisteredClaims{
            ExpiresAt: jwt.NewNumericDate(expirationTime),
        },
    }
    token := jwt.NewWithClaims(jwt.SigningMethodHS256, claims)
    return token.SignedString(jwtSecret)
}

func LoginUser(db *gorm.DB, username, password string) error {
    // Check if credentials match in the database
    return user_repository.ValidateUser(db, username, password)
}

Here's what's happening:

The LoginWithSession function manages the login request.
User credentials are validated against the user database via the LoginUser service function and the user_repository package.
Upon successful validation, a JWT is created using jwt.NewWithClaims in the services.GenerateToken function, incorporating the username and an expiration claim.
The JWT is signed and stored in a session_token cookie, effectively initiating a user session. This functionality is crucial for securely maintaining user sessions across different client requests.

Validating User Sessions

To validate user sessions, we'll introduce a CheckSession controller function:

controllers package:

// ... previous code

func CheckSession(c *gin.Context) {
    // Retrieve the session token from cookies
    sessionToken, err := c.Cookie("session_token")
    if err != nil {
        c.JSON(http.StatusUnauthorized, gin.H{"error": "Session not found"})
        return
    }

    claims, err := services.ValidateToken(sessionToken)
    if err != nil {
        c.JSON(http.StatusUnauthorized, gin.H{"error": "Invalid session"})
        return
    }

    c.JSON(http.StatusOK, gin.H{"message": "Session is valid", "username": claims.Username})
}

// ... previous code

func CheckSession(c *gin.Context) {
    // Retrieve the session token from cookies
    sessionToken, err := c.Cookie("session_token")
    if err != nil {
        c.JSON(http.StatusUnauthorized, gin.H{"error": "Session not found"})
        return
    }

    claims, err := services.ValidateToken(sessionToken)
    if err != nil {
        c.JSON(http.StatusUnauthorized, gin.H{"error": "Invalid session"})
        return
    }

    c.JSON(http.StatusOK, gin.H{"message": "Session is valid", "username": claims.Username})
}

services package:

/// ... previous code

func ValidateToken(tokenString string) (*Claims, error) {
    claims := &Claims{}
    // Validate token with secret key
    token, err := jwt.ParseWithClaims(tokenString, claims, func(token *jwt.Token) (interface{}, error) {
        return jwtSecret, nil
    })
    if err != nil || !token.Valid {
        return nil, err
    }
    return claims, nil
}

/// ... previous code

func ValidateToken(tokenString string) (*Claims, error) {
    claims := &Claims{}
    // Validate token with secret key
    token, err := jwt.ParseWithClaims(tokenString, claims, func(token *jwt.Token) (interface{}, error) {
        return jwtSecret, nil
    })
    if err != nil || !token.Valid {
        return nil, err
    }
    return claims, nil
}

Breaking down the above:

The CheckSession function retrieves and verifies the session_token cookie via the ValidateToken service function.
If the token is missing or invalid, an unauthorized response is returned.
Instead, if the token is valid, the JWT is parsed and verified with the jwtSecret.
For valid tokens, the server responds with the user’s verified session status.

This process ensures that only authenticated users can maintain active sessions, reinforcing application security.

Pros:

State Maintenance: Cookies help maintain user sessions across multiple requests.
Browser Support: Well-supported across all modern web browsers.
Automatic Handling: Browsers handle cookies automatically, reducing the need for explicit client-side scripting.

Cons:

Size Limits: Cookies have size limits, typically around 4KB, which may restrict large session data storage.
Potential Security Vulnerabilities: Cookies can be targeted in attacks like XSS if not adequately secured.
Client Visibility: Cookies are stored on the client side and can potentially be read or modified by the user.

To protect user sessions effectively and enhance the user experience, consider the following practices:

HttpOnly Flag: Prevents JavaScript access to cookies, mitigating XSS risks.
Secure Flag: Ensures cookies are sent only over secure HTTPS connections.
Sensitive Data Management: Store sensitive data, like jwtSecret, using environment variables and keep them secure from exposure.
Session Expiry Management: Implement user-friendly handling of expired sessions by redirecting users to the login page seamlessly.

Ensuring the security of user sessions is crucial for both user trust and application integrity.

In this lesson, you learned to manage user sessions using cookies in a Gin-based application. By leveraging JWTs stored in cookies, you can maintain state securely across HTTP requests. Understanding how to implement login functionality with session cookies and validate sessions are key steps in enhancing the security and reliability of your applications.

Dive into the practical exercises ahead to solidify these concepts and continue to build secure web applications.

Introduction to User Sessions with Cookies

Understanding Cookies

Join the 1M+ learners on CodeSignal

Implementing Login Functionality with Session Management

Validating User Sessions

Pros and Cons of Using Cookies

Enhancing Security and User Experience

Summary and Next Steps