v0.13.0

What's Changed

• Add option to always save session by @0rzech in #216

New Contributors

• @0rzech made their first contribution in #216

Full Changelog: v0.12.3...v0.13.0

v0.12.3

What's Changed

• Ensure continuously_delete_expired waits for initial run #208

New Contributors

• @Calum4 made their first contribution in #208

Full Changelog: v0.12.2...v0.12.3

v0.12.2

What's Changed

• Ensure set_expiry mutates Max-Age by @Katze864 in #191

New Contributors

• @Katze864 made their first contribution in #191

Full Changelog: v0.12.1...v0.12.2

v0.12.1

What's Changed

Important Security Update

• Ensure ID cycling invokes create. #188

Because cycling the session ID involves creating a new ID, this must follow the same semantics as normal session creation. Therefore prior to this fix session ID collision could occur through this vector.

New Contributors

• @myOmikron made their first contribution in #187

Full Changelog: v0.12.0...v0.12.1

v0.12.0

What's Changed

Important Security Update

• Id collision mitigation. #181

This release introduces a new method, create, to the SessionStore trait to distinguish between creating a new session and updating an existing one. This distinction is crucial for mitigating the potential for session ID collisions.

Although the probability of session ID collisions is statistically low, given that IDs are composed of securely-random i128 values, such collisions pose a significant security risk. A store that does not differentiate between session creation and updates could inadvertently allow an existing session to be accessed, leading to potential session takeovers.

Session store authors are strongly encouraged to update and implement create such that potential ID collisions are handled, either by generating a new ID or returning an error.

As a transitional measure, we have provided a default implementation of create that wraps the existing save method. However, this default is not immune to the original issue. Therefore, it is imperative that stores override the create method with an implementation that adheres to the required uniqueness semantics, thereby effectively mitigating the risk of session ID collisions.

Thanks to @wt for discovering this issue and working through our design to address! 🙇

Full Changelog: v0.11.1...v0.12.0

v0.11.1

What's Changed

• Ensure session.set_expiry updates record. #175
• Provide signed and private features, enabling signing and encryption respectively. #157

New Contributors

• @plasticbox made their first contribution in #167
• @daybowbow-dev made their first contribution in #168
• @wt made their first contribution in #170

Full Changelog: v0.11.0...v0.11.1

v0.11.0

What's Changed

• Uses slices when encoding and decoding Id. #159

Breaking Changes

• Removes IdError type in favor of using base64::DecodeSliceError. #159
• Provides the same changes as 0.10.4, without breaking SemVer.
• Updates base64 to 0.22.0.

New Contributors

• @Zatzou made their first contribution in #164

Full Changelog: v0.10.4...v0.11.0

v0.10.4

What's Changed

• Revert introduction of lifetime parameter; use static lifetime directly

This ensures that the changes introduced in 0.10.3 do not break SemVer.

Please note that 0.10.3 has been yanked in accordance with cargo guidelines.

Full Changelog: v0.10.3...v0.10.4

v0.10.3

What's Changed

• Improve session config allocation footprint #158

New Contributors

• @patte made their first contribution in #156

Full Changelog: v0.10.2...v0.10.3

v0.10.2

What's Changed

• Ensure "Path" and "Domain" are set on removal cookie #154

Full Changelog: v0.10.1...v0.10.2