dotnet / dotnet/aspnetcore

Custom generator for sessionKey in SessionMiddleware

Open
#60,869 0 comments 0 reactions 0 assignees View on GitHub
area-middleware feature-session
Dominant language
C#
Stars
38.4k
Forks
10.9k
Avg merge
2d 10h
Merged PRs (30d)
281

Description

### Is there an existing issue for this?

- [x] I have searched the existing issues

### Is your feature request related to a problem? Please describe the problem.

While reviewing options to migrate from `IHttpModule` and `IHttpSessionState` (.Net Framework 4.8) to `ISessionStore` and `ISession` (.Net 8) we noticed that there's no modern equivalent for `ISessionIDManager`. While it's not a big problem (old project already works with Guids), it would be nice to provide custom generator (and possibly validator)

### Describe the solution you'd like

1. Create a new interface ISessionKeyGenerator (feel free to suggest a better name)
```
public interface ISessionKeyGenerator
{
string Generate();
//bool IsValid(string sessionKey);
}
```
2. As a default implementation, use lines 71-76 from src/Middleware/Session/src/SessionMiddleware.cs
```
public class DefaultSessionKeyGenerator : ISessionKeyGenerator
{
public string Generate()
{
Span guidBytes = stackalloc byte[16];
RandomNumberGenerator.Fill(guidBytes);
return new Guid(guidBytes).ToString();
}
}
```
3. Extend the src/Middleware/Session/src/SessionOptions.cs with a new property
`public ISessionKeyGenerator SessionKeyGenerator { get; set; } = new DefaultSessionKeyGenerator();`
4. Replace the session key generation call in line 69 of src/Middleware/Session/src/SessionMiddleware.cs
`sessionKey = _options.SessionKeyGenerator.Generate();`

### Additional context

_No response_

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.