io.vertx.ext.web.handler

## Interface SessionHandler

- All Superinterfaces:
    Handler<RoutingContext>

      public interface SessionHandler
      extends Handler<RoutingContext>

  A handler that maintains a `Session` for each browser session.

  It looks up the session for each request based on a session cookie which contains a session ID. It stores the session when the response is ended in the session store.

  The session is available on the routing context with `RoutingContext.session()`.

  Author:
    Tim Fox

- - ### Field Summary

    Fields
    Modifier and Type | Field and Description
    --- | ---
    `static boolean` | `DEFAULT_COOKIE_HTTP_ONLY_FLAG` Default of whether the cookie has the HttpOnly flag set More info: https://www.owasp.org/index.php/HttpOnly
    `static boolean` | `DEFAULT_COOKIE_SECURE_FLAG` Default of whether the cookie has the 'secure' flag set to allow transmission over https only.
    `static boolean` | `DEFAULT_NAG_HTTPS` Default of whether a nagging log warning should be written if the session handler is accessed over HTTP, not HTTPS
    `static String` | `DEFAULT_SESSION_COOKIE_NAME` Default name of session cookie
    `static String` | `DEFAULT_SESSION_COOKIE_PATH` Default path of session cookie
    `static long` | `DEFAULT_SESSION_TIMEOUT` Default time, in ms, that a session lasts for without being accessed before expiring.
    `static int` | `DEFAULT_SESSIONID_MIN_LENGTH` Default min length for a session id.

  - ### Method Summary

    All Methods Static Methods Instance Methods Abstract Methods Default Methods
    Modifier and Type | Method and Description
    --- | ---
    `static SessionHandler` | `create(SessionStore sessionStore)` Create a session handler
    `SessionHandler` | `setAuthProvider(AuthProvider authProvider)` Set an auth provider that will allow retrieving the User object from the session to the current routing context.
    `SessionHandler` | `setCookieHttpOnlyFlag(boolean httpOnly)` Sets whether the 'HttpOnly' flag should be set for the session cookie.
    `SessionHandler` | `setCookieSameSite(CookieSameSite policy)` Set the session cookie SameSite policy to use.
    `SessionHandler` | `setCookieSecureFlag(boolean secure)` Sets whether the 'secure' flag should be set for the session cookie.
    `SessionHandler` | `setMinLength(int minLength)` Set expected session id minimum length.
    `SessionHandler` | `setNagHttps(boolean nag)` Set whether a nagging log warning should be written if the session handler is accessed over HTTP, not HTTPS
    `SessionHandler` | `setSessionCookieName(String sessionCookieName)` Set the session cookie name
    `SessionHandler` | `setSessionCookiePath(String sessionCookiePath)` Set the session cookie path
    `SessionHandler` | `setSessionTimeout(long timeout)` Set the session timeout

    - ### Methods inherited from interface io.vertx.core.Handler

      `handle`

- - ### Field Detail

    - #### DEFAULT_SESSION_COOKIE_NAME

          static final String DEFAULT_SESSION_COOKIE_NAME

      Default name of session cookie
      See Also:
        Constant Field Values

    - #### DEFAULT_SESSION_COOKIE_PATH

          static final String DEFAULT_SESSION_COOKIE_PATH

      Default path of session cookie
      See Also:
        Constant Field Values

    - #### DEFAULT_SESSION_TIMEOUT

          static final long DEFAULT_SESSION_TIMEOUT

      Default time, in ms, that a session lasts for without being accessed before expiring.
      See Also:
        Constant Field Values

    - #### DEFAULT_NAG_HTTPS

          static final boolean DEFAULT_NAG_HTTPS

      Default of whether a nagging log warning should be written if the session handler is accessed over HTTP, not HTTPS
      See Also:
        Constant Field Values

    - #### DEFAULT_COOKIE_HTTP_ONLY_FLAG

          static final boolean DEFAULT_COOKIE_HTTP_ONLY_FLAG

      Default of whether the cookie has the HttpOnly flag set More info: https://www.owasp.org/index.php/HttpOnly
      See Also:
        Constant Field Values

    - #### DEFAULT_COOKIE_SECURE_FLAG

          static final boolean DEFAULT_COOKIE_SECURE_FLAG

      Default of whether the cookie has the 'secure' flag set to allow transmission over https only. More info: https://www.owasp.org/index.php/SecureFlag
      See Also:
        Constant Field Values

    - #### DEFAULT_SESSIONID_MIN_LENGTH

          static final int DEFAULT_SESSIONID_MIN_LENGTH

      Default min length for a session id. More info: https://www.owasp.org/index.php/Session_Management_Cheat_Sheet
      See Also:
        Constant Field Values

  - ### Method Detail

    - #### create

          static SessionHandler create(SessionStore sessionStore)

      Create a session handler
      Parameters:
        `sessionStore` - the session store
      Returns:
        the handler

    - #### setSessionTimeout

          SessionHandler setSessionTimeout(long timeout)

      Set the session timeout
      Parameters:
        `timeout` - the timeout, in ms.
      Returns:
        a reference to this, so the API can be used fluently

    - #### setNagHttps

          SessionHandler setNagHttps(boolean nag)

      Set whether a nagging log warning should be written if the session handler is accessed over HTTP, not HTTPS
      Parameters:
        `nag` - true to nag
      Returns:
        a reference to this, so the API can be used fluently

    - #### setCookieSecureFlag

          SessionHandler setCookieSecureFlag(boolean secure)

      Sets whether the 'secure' flag should be set for the session cookie. When set this flag instructs browsers to only send the cookie over HTTPS. Note that this will probably stop your sessions working if used without HTTPS (e.g. in development).
      Parameters:
        `secure` - true to set the secure flag on the cookie
      Returns:
        a reference to this, so the API can be used fluently

    - #### setCookieHttpOnlyFlag

          SessionHandler setCookieHttpOnlyFlag(boolean httpOnly)

      Sets whether the 'HttpOnly' flag should be set for the session cookie. When set this flag instructs browsers to prevent Javascript access to the the cookie. Used as a line of defence against the most common XSS attacks.
      Parameters:
        `httpOnly` - true to set the HttpOnly flag on the cookie
      Returns:
        a reference to this, so the API can be used fluently

    - #### setSessionCookieName

          SessionHandler setSessionCookieName(String sessionCookieName)

      Set the session cookie name
      Parameters:
        `sessionCookieName` - the session cookie name
      Returns:
        a reference to this, so the API can be used fluently

    - #### setSessionCookiePath

          SessionHandler setSessionCookiePath(String sessionCookiePath)

      Set the session cookie path
      Parameters:
        `sessionCookiePath` - the session cookie path
      Returns:
        a reference to this, so the API can be used fluently

    - #### setMinLength

          SessionHandler setMinLength(int minLength)

      Set expected session id minimum length.
      Parameters:
        `minLength` - the session id minimal length
      Returns:
        a reference to this, so the API can be used fluently

    - #### setCookieSameSite

          SessionHandler setCookieSameSite(CookieSameSite policy)

      Set the session cookie SameSite policy to use.
      Parameters:
        `policy` - to use, `null` for no policy.
      Returns:
        a reference to this, so the API can be used fluently

    - #### setAuthProvider

          SessionHandler setAuthProvider(AuthProvider authProvider)

      Set an auth provider that will allow retrieving the User object from the session to the current routing context.
      Parameters:
        `authProvider` - any auth provider.
      Returns:
        a reference to this, so the API can be used fluently

Copyright © 2020 Eclipse. All rights reserved.