session: require cookie session name

- remove the default jooby.sid cookie name, users must configured session store as well as cookie name
- the default session store will generate an usage exception at runtime
- fix #3639

Author: jknack

docs/asciidoc/modules/redis.adoc

@@ -140,12 +140,12 @@ import io.jooby.redis.RedisSessionStore;
 import io.lettuce.core.RedisClient;
 
 {
-  install(new RedisModule());                                                     <1>
+  install(new RedisModule());                                                                    <1>
 
-  setSessionStore(new RedisSessionStore(require(RedisClient.class)));             <2>
+  setSessionStore(new RedisSessionStore(Cookie.session("myappid"), require(RedisClient.class))); <2>
 
   get("/", ctx -> {
-    Session httpSession = ctx.session();                                          <3>
+    Session httpSession = ctx.session();                                                         <3>
     // HTTP session is backed by Redis
   });
 }
@@ -160,12 +160,12 @@ import io.jooby.redis.RedisSessionStore
 import io.lettuce.core.RedisClient
 
 {
-  install(RedisModule())                                                           <1>
+  install(RedisModule())                                                                        <1>
   
-  sessionStore = RedisSessionStore(require(RedisClient::class))                    <2>
+  sessionStore = RedisSessionStore(Cookie.session("myappid"), require(RedisClient::class))      <2>
 
   get("/") {
-    val httpSession = ctx.session()                                                <3>
+    val httpSession = ctx.session()                                                             <3>
     // HTTP session is backed by Redis
   }
 }
@@ -179,4 +179,3 @@ More Options:
 
 - javadoc:redis.RedisSessionStore[setTimeout, java.time.Duration, artifact="jooby-redis"]: Set session timeout. Default is: `30 minutes`
 - javadoc:redis.RedisSessionStore[setNamespace, java.lang.String, artifact="jooby-redis"]: Set key prefix. Default is: `sessions`
-- javadoc:redis.RedisSessionStore[setToken, io.jooby.SessionToken, artifact="jooby-redis"]: Set session token. Default is a cookie token: `jooby.sid`

docs/asciidoc/session.adoc

@@ -13,10 +13,13 @@ objects. It's intended as a simple mechanism to store basic data (not an object
 
 Jooby provides the following javadoc:SessionStore[]:
 
-- In-Memory sessions - which you should combine with an a sticky sessions proxy if you plan to run multiple instances.
+- In-Memory sessions—which you should combine with a sticky sessions proxy if you plan to run multiple instances.
 - Cookie sessions signed with a secret key
 - JSON Web Token sessions
 
+Since 4.0.0 no session is configured by default. Attempt to access to a session at runtime results
+in exception.
+
 === In-Memory Session
 
 Default session store uses memory to save session data. This store:
@@ -28,6 +31,8 @@ Default session store uses memory to save session data. This store:
 [source,java,role="primary"]
 ----
 {
+  setSessionStore(SessionStore.memory(Cookie.session("myappid")));
+
   get("/", ctx -> {
     Session session = ctx.session();   // <1>
 
@@ -42,6 +47,8 @@ Default session store uses memory to save session data. This store:
 [source,kotlin,role="secondary"]
 ----
 {
+  setSessionStore(SessionStore.memory(Cookie.session("myappid")))
+
   get("/") {
     val session = ctx.session()        // <1>
 
@@ -56,7 +63,7 @@ Default session store uses memory to save session data. This store:
 <2> Set a session attribute
 <3> Get a session attribute
 
-Session token/ID is retrieved it from request cookie. Default session cookie is javadoc:SessionToken[SID, text=jooby.sid]. To customize cookie details:
+Session token/ID is retrieved it from request cookie. Default session cookie never expires, it is http only under the `/` path. To customize cookie details:
 
 .In-Memory Session with Custom Cookie
 [source,java,role="primary"]
@@ -92,7 +99,7 @@ Session token/ID is retrieved it from request cookie. Default session cookie is
 
 <1> Set an `in-memory` session store with a custom cookie named: `SESSION`
 
-Alternative you can use a request header to retrieve a session token/ID:
+Alternatively, you can use a request header to retrieve a session token/ID:
 
 .In-Memory Session with HTTP Header
 [source,java,role="primary"]
@@ -177,9 +184,9 @@ Data sign/unsign is done using javadoc:Cookie[sign, java.lang.String, java.lang.
 [source,java,role="primary"]
 ----
 {
-  String secret = "super secret key";              // <1>
+  String secret = "super secret key";                                         // <1>
 
-  setSessionStore(SessionStore.signed(secret));    // <2>
+  setSessionStore(SessionStore.signed(Cookie.session("myappid"), secret));    // <2>
 
   get("/", ctx -> {
     Session session = ctx.session();
@@ -195,9 +202,9 @@ Data sign/unsign is done using javadoc:Cookie[sign, java.lang.String, java.lang.
 [source,kotlin,role="secondary"]
 ----
 {
-  val secret = "super secret key"                  // <1>
+  val secret = "super secret key"                                            // <1>
 
-  sessionStore = SessionStore.signed(secret)       // <2>
+  sessionStore = SessionStore.signed(Cookie.session("myappid"),secret)       // <2>
 
   get("/") {
     val session = ctx.session()
@@ -220,7 +227,7 @@ Like with `memory` session store you can use HTTP headers:
 {
   String secret = "super secret key";                                            // <1>
 
-  setSessionStore(SessionStore.signed(secret, SessionToken.header("TOKEN")));    // <2>
+  setSessionStore(SessionStore.signed(SessionToken.header("TOKEN"), secret));    // <2>
 
   get("/", ctx -> {
     Session session = ctx.session();
@@ -238,7 +245,7 @@ Like with `memory` session store you can use HTTP headers:
 {
   val secret = "super secret key"                                                // <1>
 
-  sessionStore = SessionStore.signed(secret, SessionToken.header("TOKEN"))       // <2>
+  sessionStore = SessionStore.signed(SessionToken.header("TOKEN"), secret)       // <2>
 
   get("/") {
     val session = ctx.session()

jooby/src/main/java/io/jooby/Cookie.java

@@ -588,6 +588,17 @@ public String toString() {
     return Optional.empty();
   }
 
+  /**
+   * Creates a session cookie which never expires (maxAge: -1), is http only and path is <code>/
+   * </code>.
+   *
+   * @param sid Session ID.
+   * @return Session's cookie.
+   */
+  public static Cookie session(@NonNull String sid) {
+    return new Cookie(sid).setMaxAge(-1).setHttpOnly(true).setPath("/");
+  }
+
   private static <T> void value(
       Config conf, String name, BiFunction<Config, String, T> mapper, Consumer<T> consumer) {
     if (conf.hasPath(name)) {

jooby/src/main/java/io/jooby/SessionStore.java

@@ -27,6 +27,40 @@ public interface SessionStore {
   /** Default session timeout in minutes. */
   int DEFAULT_TIMEOUT = 30;
 
+  SessionStore UNSUPPORTED =
+      new SessionStore() {
+
+        @NonNull @Override
+        public Session newSession(@NonNull Context ctx) {
+          throw Usage.noSession();
+        }
+
+        @Nullable @Override
+        public Session findSession(@NonNull Context ctx) {
+          throw Usage.noSession();
+        }
+
+        @Override
+        public void deleteSession(@NonNull Context ctx, @NonNull Session session) {
+          throw Usage.noSession();
+        }
+
+        @Override
+        public void touchSession(@NonNull Context ctx, @NonNull Session session) {
+          throw Usage.noSession();
+        }
+
+        @Override
+        public void saveSession(@NonNull Context ctx, @NonNull Session session) {
+          throw Usage.noSession();
+        }
+
+        @Override
+        public void renewSessionId(@NonNull Context ctx, @NonNull Session session) {
+          throw Usage.noSession();
+        }
+      };
+
   /**
    * Base class for in-memory session store.
    *
@@ -35,9 +69,9 @@ public interface SessionStore {
    */
   abstract class InMemory implements SessionStore {
     protected static class Data {
-      private Instant lastAccessedTime;
-      private Instant creationTime;
-      private Map hash;
+      private final Instant lastAccessedTime;
+      private final Instant creationTime;
+      private final Map hash;
 
       public Data(Instant creationTime, Instant lastAccessedTime, Map hash) {
         this.creationTime = creationTime;
@@ -64,12 +98,12 @@ protected InMemory(@NonNull SessionToken token) {
 
     @Override
     public @NonNull Session newSession(@NonNull Context ctx) {
-      String sessionId = token.newToken();
-      Data data =
+      var sessionId = token.newToken();
+      var data =
           getOrCreate(
               sessionId, sid -> new Data(Instant.now(), Instant.now(), new ConcurrentHashMap()));
 
-      Session session = restore(ctx, sessionId, data);
+      var session = restore(ctx, sessionId, data);
 
       token.saveToken(ctx, sessionId);
       return session;
@@ -78,7 +112,7 @@ protected InMemory(@NonNull SessionToken token) {
     /**
      * Session token.
      *
-     * @return Session token. Uses a cookie by default: {@link SessionToken#SID}.
+     * @return Session token.
      */
     public @NonNull SessionToken getToken() {
       return token;
@@ -95,7 +129,7 @@ protected InMemory(@NonNull SessionToken token) {
       return this;
     }
 
-    protected abstract @NonNull Data getOrCreate(
+    protected abstract Data getOrCreate(
         @NonNull String sessionId, @NonNull Function<String, Data> factory);
 
     protected abstract @Nullable Data getOrNull(@NonNull String sessionId);
@@ -105,7 +139,7 @@ protected InMemory(@NonNull SessionToken token) {
     protected abstract void put(@NonNull String sessionId, @NonNull Data data);
 
     @Override
-    public Session findSession(Context ctx) {
+    public @Nullable Session findSession(@NonNull Context ctx) {
       String sessionId = token.findToken(ctx);
       if (sessionId == null) {
         return null;
@@ -219,48 +253,6 @@ private Session restore(Context ctx, String sessionId, Data data) {
    */
   void renewSessionId(@NonNull Context ctx, @NonNull Session session);
 
-  /**
-   * Creates a cookie based session and store data in memory. Session data is not keep after
-   * restart.
-   *
-   * <p>It uses the default session cookie: {@link SessionToken#SID}.
-   *
-   * <p>- Session data is not keep after restart.
-   *
-   * @param timeout Timeout in seconds. Use <code>-1</code> for no timeout.
-   * @return Session store.
-   */
-  static @NonNull SessionStore memory(int timeout) {
-    return memory(SessionToken.SID, Duration.ofSeconds(timeout));
-  }
-
-  /**
-   * Creates a cookie based session and store data in memory. Session data is not keep after
-   * restart.
-   *
-   * <p>It uses the default session cookie: {@link SessionToken#SID}.
-   *
-   * <p>- Session expires after 30 minutes of inactivity. - Session data is not keep after restart.
-   *
-   * @return Session store.
-   */
-  static @NonNull SessionStore memory() {
-    return memory(SessionToken.SID);
-  }
-
-  /**
-   * Creates a cookie based session and store data in memory. Session data is not keep after
-   * restart.
-   *
-   * <p>It uses the default session cookie: {@link SessionToken#SID}.
-   *
-   * @param timeout Expires session after amount of inactivity time.
-   * @return Session store.
-   */
-  static @NonNull SessionStore memory(@NonNull Duration timeout) {
-    return memory(SessionToken.SID, timeout);
-  }
-
   /**
    * Creates a cookie based session and store data in memory.
    *
@@ -313,25 +305,12 @@ private Session restore(Context ctx, String sessionId, Data data) {
    *
    * <p>See {@link Cookie#sign(String, String)} and {@link Cookie#unsign(String, String)}.
    *
-   * @param secret Secret token to signed data.
-   * @return A browser session store.
-   */
-  static @NonNull SessionStore signed(@NonNull String secret) {
-    return signed(secret, SessionToken.SID);
-  }
-
-  /**
-   * Creates a session store that uses (un)signed data. Session data is signed it using <code>
-   * HMAC_SHA256</code>.
-   *
-   * <p>See {@link Cookie#sign(String, String)} and {@link Cookie#unsign(String, String)}.
-   *
-   * @param secret Secret token to signed data.
    * @param cookie Cookie to use.
+   * @param secret Secret token to signed data.
    * @return A browser session store.
    */
-  static @NonNull SessionStore signed(@NonNull String secret, @NonNull Cookie cookie) {
-    return signed(secret, SessionToken.signedCookie(cookie));
+  static @NonNull SessionStore signed(@NonNull Cookie cookie, @NonNull String secret) {
+    return signed(SessionToken.signedCookie(cookie), secret);
   }
 
   /**
@@ -340,11 +319,11 @@ private Session restore(Context ctx, String sessionId, Data data) {
    *
    * <p>See {@link Cookie#sign(String, String)} and {@link Cookie#unsign(String, String)}.
    *
-   * @param secret Secret token to signed data.
    * @param token Session token to use.
+   * @param secret Secret token to signed data.
    * @return A browser session store.
    */
-  static @NonNull SessionStore signed(@NonNull String secret, @NonNull SessionToken token) {
+  static @NonNull SessionStore signed(@NonNull SessionToken token, @NonNull String secret) {
     SneakyThrows.Function<String, Map<String, String>> decoder =
         value -> {
           String unsign = Cookie.unsign(value, secret);

jooby/src/main/java/io/jooby/SessionToken.java

@@ -46,12 +46,7 @@ public String findToken(@NonNull Context ctx) {
 
     @Override
     public void saveToken(@NonNull Context ctx, @NonNull String token) {
-      // FIXME: Review, bc we don;t need this
-      //  String existingId = findToken(ctx);
-      // write cookie for new or expiring session
-      // if (existingId == null || cookie.getMaxAge() > 0) {
       ctx.setResponseCookie(cookie.clone().setValue(token));
-      // }
     }
 
     @Override
@@ -64,7 +59,7 @@ public void deleteToken(@NonNull Context ctx, @NonNull String token) {
    * Looks for a session ID from request headers. This strategy:
    *
    * <p>- find a token from a request header. - on save, send the header back as response header. -
-   * on session destroy. don't send response header back.
+   * on session destruction. don't send response header back.
    */
   class HeaderID implements SessionToken {
 
@@ -130,12 +125,6 @@ public void deleteToken(@NonNull Context ctx, @NonNull String token) {
     }
   }
 
-  /**
-   * Default cookie for cookie based session stores. Uses <code>jooby.sid</code> as name. It never
-   * expires, use the root, only for HTTP.
-   */
-  Cookie SID = new Cookie("jooby.sid").setMaxAge(-1).setHttpOnly(true).setPath("/");
-
   /** Secure random for default session token generator. */
   SecureRandom RND = new SecureRandom();
 

jooby/src/main/java/io/jooby/Usage.java

@@ -23,17 +23,25 @@ public class Usage extends RuntimeException {
    * Creates a new Usage exception.
    *
    * @param message Message.
-   * @param id Link to detailed section.
+   * @param id Link to a detailed section.
    */
   public Usage(@NonNull String message, @NonNull String id) {
-    super(
+    this(
         (message
             + "\nFor more details, please visit: "
             + System.getProperty("jooby.host", "https://jooby.io")
             + "/usage#"
             + id));
   }
 
+  protected Usage(@NonNull String message) {
+    super(message);
+  }
+
+  public static @NonNull Usage noSession() {
+    return new Usage("No session available. See https://jooby.io/#session-in-memory-session");
+  }
+
   /**
    * Creates a mvc route missing exception.
    *