Sessions & Cookies

[dependencies]
tower-sessions = "0.14.0"               # not 0.15: axum-login 0.18 and the stores need 0.14
tower-sessions-redis-store = "0.16.0"
time = "0.3"                            # Expiry uses time::Duration

use std::collections::HashMap;
use std::sync::Arc;

use argon2::{
    Argon2,
    password_hash::{PasswordHasher, PasswordVerifier, phc::PasswordHash},
};
use axum::{
    Form, Router,
    extract::State,
    response::{Html, IntoResponse, Redirect},
    routing::{get, post},
};
use serde::{Deserialize, Serialize};
use time::OffsetDateTime;
use tower_sessions::{
    Expiry, Session, SessionManagerLayer,
    cookie::{SameSite, time::Duration},
};
use tower_sessions_redis_store::{RedisStore, fred::prelude::*};

/// Everything the application keeps in the session, under one key.
#[derive(Serialize, Deserialize)]
struct SignedIn {
    user_id: i64,
    since: i64, // unix seconds, for the absolute timeout
}

impl SignedIn {
    const KEY: &'static str = "signed_in";
    const ABSOLUTE_TIMEOUT_SECS: i64 = 12 * 60 * 60;
}

#[derive(Clone)]
struct AppState {
    users: Arc<HashMap<String, (i64, String)>>, // username -> (id, Argon2id PHC string)
}

#[derive(Deserialize)]
struct Login {
    username: String,
    password: String,
}

async fn verify(password: String, phc: String) -> bool {
    tokio::task::spawn_blocking(move || {
        PasswordHash::new(&phc).is_ok_and(|h| Argon2::default().verify_password(password.as_bytes(), &h).is_ok())
    })
    .await
    .unwrap_or(false)
}

async fn login(State(state): State<AppState>, session: Session, Form(form): Form<Login>) -> Redirect {
    let Some((user_id, phc)) = state.users.get(&form.username).cloned() else {
        return Redirect::to("/login?error=1"); // see Password Authentication for the timing-safe version
    };
    if !verify(form.password, phc).await {
        return Redirect::to("/login?error=1");
    }
    // new id on every privilege change: defeats session fixation
    let signed_in = SignedIn { user_id, since: OffsetDateTime::now_utc().unix_timestamp() };
    if session.cycle_id().await.is_err() || session.insert(SignedIn::KEY, signed_in).await.is_err() {
        return Redirect::to("/login?error=2");
    }
    Redirect::to("/account")
}

async fn account(session: Session) -> impl IntoResponse {
    match session.get::<SignedIn>(SignedIn::KEY).await {
        Ok(Some(s)) if OffsetDateTime::now_utc().unix_timestamp() - s.since < SignedIn::ABSOLUTE_TIMEOUT_SECS => {
            Html(format!("<p>signed in as user {}</p>", s.user_id)).into_response()
        }
        Ok(Some(_)) => {
            let _ = session.flush().await; // absolute timeout reached: sign out
            Redirect::to("/login?expired=1").into_response()
        }
        _ => Redirect::to("/login").into_response(),
    }
}

async fn logout(session: Session) -> Redirect {
    // delete the server-side record AND the cookie
    let _ = session.flush().await;
    Redirect::to("/")
}

#[tokio::main]
async fn main() -> Result<(), Box<dyn std::error::Error>> {
    // REDIS_URL is not a secret here; production URLs with a password come from a secret store
    let config = Config::from_url(&std::env::var("REDIS_URL").unwrap_or_else(|_| "redis://127.0.0.1:6379".into()))?;
    let pool = Pool::new(config, None, None, None, 4)?;
    let _connection_task = pool.connect();
    pool.wait_for_connect().await?;

    // demo user table: production reads the PHC string from the `users` table
    let password = std::env::var("DEMO_PASSWORD").expect("DEMO_PASSWORD must be set");
    let phc = Argon2::default().hash_password(password.as_bytes()).expect("hash").to_string();
    let state = AppState { users: Arc::new(HashMap::from([("ursula".to_owned(), (42, phc))])) };

    let sessions = SessionManagerLayer::new(RedisStore::new(pool))
        .with_name("__Host-bookshelf")      // __Host-: Secure, Path=/, no Domain enforced by browsers
        .with_secure(true)
        .with_http_only(true)               // the default; JavaScript cannot read the cookie
        .with_same_site(SameSite::Lax)      // sent on top-level navigation, not on cross-site POSTs
        .with_path("/")
        .with_expiry(Expiry::OnInactivity(Duration::hours(8)))
        .with_always_save(true);            // slide the inactivity deadline on every request

    let app = Router::new()
        .route("/login", post(login))
        .route("/account", get(account))
        .route("/logout", post(logout))
        .layer(sessions)
        .with_state(state);
    let listener = tokio::net::TcpListener::bind("127.0.0.1:3000").await?;
    axum::serve(listener, app).await?;
    Ok(())
}

$ export DEMO_PASSWORD=$(openssl rand -base64 18)
$ cargo run &
$ curl -si --data-urlencode username=ursula --data-urlencode "password=$DEMO_PASSWORD" localhost:3000/login |
    grep -i -E '^HTTP|location|set-cookie'
HTTP/1.1 303 See Other
location: /account
set-cookie: __Host-bookshelf=IMTM5q9pBSX2ErTxcENx7Q; HttpOnly; SameSite=Lax; Secure; Path=/; Max-Age=28800
$ curl -s -H 'cookie: __Host-bookshelf=IMTM5q9pBSX2ErTxcENx7Q' localhost:3000/account
<p>signed in as user 42</p>
$ redis-cli --scan; redis-cli ttl IMTM5q9pBSX2ErTxcENx7Q
IMTM5q9pBSX2ErTxcENx7Q
28799
$ curl -s -o /dev/null -w '%{http_code}\n' -H 'cookie: __Host-bookshelf=IMTM5q9pBSX2ErTxcENx7Q' -X POST localhost:3000/logout
303
$ redis-cli --scan | wc -l
0

use axum::{
    Router,
    body::Body,
    http::{Request, header},
    routing::{get, post},
};
use tower::ServiceExt; // for `oneshot`
use tower_sessions::{MemoryStore, Session, SessionManagerLayer};

async fn sign_in(session: Session) -> &'static str {
    session.cycle_id().await.expect("cycle id");
    session.insert("user_id", 42_i64).await.expect("insert");
    "ok"
}

async fn whoami(session: Session) -> String {
    format!("{:?}", session.get::<i64>("user_id").await.expect("load"))
}

fn app() -> Router {
    let layer = SessionManagerLayer::new(MemoryStore::default()).with_secure(false);
    Router::new().route("/sign-in", post(sign_in)).route("/whoami", get(whoami)).layer(layer)
}

/// The `name=value` part of the response's Set-Cookie header.
fn session_cookie(res: &axum::response::Response) -> String {
    let set_cookie = res.headers()[header::SET_COOKIE].to_str().expect("ascii");
    set_cookie.split(';').next().expect("name=value").to_owned()
}

async fn body(res: axum::response::Response) -> String {
    let bytes = axum::body::to_bytes(res.into_body(), 1024).await.expect("body");
    String::from_utf8(bytes.to_vec()).expect("utf-8")
}

#[tokio::main]
async fn main() {
    let app = app(); // one Router, so one MemoryStore, shared by every request below

    // an attacker-planted (well-formed) session id: login must not keep it
    let planted = "id=AAAAAAAAAAAAAAAAAAAAAA";
    let req = Request::post("/sign-in").header(header::COOKIE, planted).body(Body::empty()).unwrap();
    let res = app.clone().oneshot(req).await.unwrap();
    let cookie = session_cookie(&res);
    assert_ne!(cookie, planted, "session id must change on login");

    let req = Request::get("/whoami").header(header::COOKIE, &cookie).body(Body::empty()).unwrap();
    assert_eq!(body(app.clone().oneshot(req).await.unwrap()).await, "Some(42)");

    let req = Request::get("/whoami").body(Body::empty()).unwrap(); // no cookie: anonymous
    assert_eq!(body(app.oneshot(req).await.unwrap()).await, "None");
    println!("session tests passed ({cookie})");
}

$ cargo run --example session_tests
session tests passed (id=7VtwP5NxuvzKqAezA5Gweg)