Hi, i am trying to integrate sessions with tower sessions but session resetting after each request

[emirbaycan]

Here my main function file which i added the sesion layer

`#[tokio::main]
async fn main() {
dotenv().ok();

let images = Path::new("images");
if !images.exists() {
    fs::create_dir(images).ok();
}

let database_url = std::env::var("DATABASE_URL").expect("DATABASE_URL must be set");
let pool = PgPool::connect(&database_url).await.unwrap();

let session_store = PostgresStore::new(pool.clone());
let session_store_result = session_store.migrate().await;

if session_store_result.is_err() {
    println!("Session store couldnt migrate");
}

let deletion_task = tokio::task::spawn(
    session_store
        .clone()
        .continuously_delete_expired(tokio::time::Duration::from_secs(60)),
);

let session_layer = SessionManagerLayer::new(session_store)
    .with_secure(true)
    .with_expiry(Expiry::OnInactivity(Duration::seconds(1800)));

let cors = CorsLayer::new()
    .allow_origin("http://localhost:5173".parse::<HeaderValue>().unwrap())
    .allow_methods([Method::GET, Method::POST, Method::PATCH, Method::DELETE])
    .allow_credentials(true)
    .allow_headers([AUTHORIZATION, ACCEPT, CONTENT_TYPE]);

let app = create_router(Arc::new(AppState { db: pool.clone() })).layer(session_layer).layer(cors);

println!("🚀 Server started successfully");
let listener = tokio::net::TcpListener::bind("0.0.0.0:1998").await.unwrap();
axum::serve(listener, app.into_make_service()).await.unwrap();

deletion_task.await.unwrap().unwrap();

}`

in my login handler function's end i inserted to session the test value as 1, and in the begining of the function i printed the session test value.

Results

After i run this handler several times session test value always printed as None.
session.id() value always printed as null
When i tried to get the test value after function continiues successfully printing
Also in the set-cookie header session id is always different

Conclusion

Session is not storaged or always resetting

`
pub async fn login_handler(
session: Session,
State(data): State<Arc>,
Json(body): Json,
) -> Result<impl IntoResponse, (StatusCode, Json<serde_json::Value>)> {

let test = session.get::<usize>("test").await.unwrap();
println!("Session value is: {:?}", test);

let email = body.email.unwrap();
let password = body.password.unwrap();

let query_result = sqlx::query_as!(
    User,
    "SELECT id,username,email,password,fullname,role,avatar,active FROM users WHERE email=$1",
    email
)
.fetch_one(&data.db)
.await;

if query_result.is_err() {
    let error_response = serde_json::json!({
        "status": "fail",
        "message": "User not exists",
    });
    return Err((StatusCode::NOT_FOUND, Json(error_response)));
}

let item = query_result.unwrap();

let password_hash = item.password.clone();
let valid = verify(&password, &password_hash).unwrap();

if !valid {
    let error_response = serde_json::json!({
        "status": "fail",
        "message": "Passwords did not match",
    });
    return Err((StatusCode::NOT_ACCEPTABLE, Json(error_response)));
}

let user = serde_json::json!({
    "id":item.id,
    "email":item.email,
    "username":item.username,
    "fullname":item.fullname,
    "password":"",
    "role":item.role,
    "avatar":item.avatar,
    "active":item.active
});

session.insert("test", 1).await.unwrap();

let json_response = serde_json::json!({
    "status": "success",
    "data": item,
    "session_id":session.id()
});

Ok((StatusCode::OK, Json(json_response)))

}`

[maxcountryman]

Can you provide a runnable example?

Also please try one of the provided examples: can you produce the same problem with one of those?

[emirbaycan]

I wrote this to check if the session working properly and it is working with this way

  mod general;
  
  mod detail;
  mod job;
  mod project;
  mod testimonial;
  
  mod auth;
  mod image;
  mod user;
  
  mod route;
  
  use std::sync::Arc;
  
  use std::fs;
  use std::path::Path;
  
  use auth::schema::User;
  use axum::{
      extract::{Request, State}, http::{
          header::{ACCEPT, AUTHORIZATION, CONTENT_TYPE},
          HeaderValue, Method,
      }, middleware::Next, response::{IntoResponse, Response}, Json
  };
  use dotenv::dotenv;
  use reqwest::StatusCode;
  use route::create_router;
  use tower_http::cors::CorsLayer;
  
  use sqlx::{Pool, Postgres};
  
  use time::Duration;
  
  use tower_sessions::{session_store::ExpiredDeletion, Expiry, Session, SessionManagerLayer};
  use tower_sessions_sqlx_store::{sqlx::PgPool, PostgresStore};
  
  pub struct AppState {
      db: Pool<Postgres>,
  }
  
  use axum::{
      middleware,
      routing::{get, post},
      Router,
  };
  use uuid::{uuid, Uuid};
  
  pub async fn authenticate(
      session: Session,
      request: Request,
      next: Next,
  ) -> Result<Response, (StatusCode, impl IntoResponse)> { 
      // Check if the user is logged in
      if let Ok(Some(logged_in)) = session.get::<usize>("logged_in").await {
          // If logged in, continue processing the request
          let response = next.run(request).await;
          Ok(response)
      
      } else {
          let error_response = serde_json::json!({
              "error": "Unauthorized",
          });
          Err((StatusCode::UNAUTHORIZED, Json(error_response)))
      }
  }
  
  
  pub async fn show(
      session: Session,
      State(data): State<Arc<AppState>>,
  ) -> Result<impl IntoResponse, (StatusCode, Json<serde_json::Value>)> {
      let user = session
          .get::<User>("user")
          .await
          .unwrap()
          .unwrap_or_default();
      let counter = session
          .get::<usize>("counter")
          .await
          .unwrap()
          .unwrap_or_default()
          + 1;
  
      session.insert("counter", counter).await.unwrap();
  
      let json_response = serde_json::json!({
          "status": "success",
          "user": user,
          "counter":counter,
      });
  
      Ok(Json(json_response))
  }
  
  pub async fn login(
      session: Session,
      State(data): State<Arc<AppState>>,
  ) -> Result<impl IntoResponse, (StatusCode, Json<serde_json::Value>)> {
      let user = serde_json::json!({
          "id":Uuid::new_v4(),
          "email":"*",
          "username":"*",
          "fullname":"*",
          "password":"*",
          "role":1,
          "avatar":"*",
          "active":1
      });
  
      let counter = 1;
  
      session.insert("logged_in", 1).await.unwrap();
      session.insert("user", user.clone()).await.unwrap();
      session.insert("counter", counter).await.unwrap();
  
      let json_response = serde_json::json!({
          "status": "success",
          "user": user,
          "counter":counter,
      });
  
      Ok(Json(json_response))
  }
  
  pub async fn logout(
      session: Session,
      State(data): State<Arc<AppState>>,
  ) -> Result<impl IntoResponse, (StatusCode, Json<serde_json::Value>)> {
      session.flush().await.unwrap();
  
      let json_response = serde_json::json!({
          "status": "success",
      });
  
      Ok(Json(json_response))
  }
  
  pub fn user_router(app_state: Arc<AppState>) -> Router {
      Router::new()
          .route("/show", get(show))
          .route("/logout", get(logout))
          .layer(middleware::from_fn(authenticate))
          .route("/login", get(login))
          .with_state(app_state)
  }
  
  pub fn create_routes(app_state: Arc<AppState>) -> Router {
      let user_route = user_router(app_state);
      Router::new().merge(user_route)
  }
  
  #[tokio::main]
  async fn main() {
      dotenv().ok();
  
      let images = Path::new("images");
      if !images.exists() {
          fs::create_dir(images).ok();
      }
  
      let database_url = std::env::var("DATABASE_URL").expect("DATABASE_URL must be set");
      let pool = PgPool::connect(&database_url).await.unwrap();
  
      let session_store = PostgresStore::new(pool.clone());
      let session_store_result = session_store.migrate().await;
  
      if session_store_result.is_err() {
          println!("Session store couldnt migrate");
      }
  
      let deletion_task = tokio::task::spawn(
          session_store
              .clone()
              .continuously_delete_expired(tokio::time::Duration::from_secs(60)),
      );
  
      let session_layer = SessionManagerLayer::new(session_store)
          .with_secure(true)
          .with_expiry(Expiry::OnInactivity(Duration::seconds(1800)));
  
      let cors = CorsLayer::new()
          .allow_origin("http://localhost:5173".parse::<HeaderValue>().unwrap())
          .allow_methods([Method::GET, Method::POST, Method::PATCH, Method::DELETE])
          .allow_credentials(true)
          .allow_headers([AUTHORIZATION, ACCEPT, CONTENT_TYPE]);
  
      let app = create_routes(Arc::new(AppState { db: pool.clone() }))
          .layer(session_layer)
          .layer(cors);
  
      println!("🚀 Server started successfully");
      let listener = tokio::net::TcpListener::bind("0.0.0.0:1998").await.unwrap();
      axum::serve(listener, app.into_make_service())
          .await
          .unwrap();
  
      deletion_task.await.unwrap().unwrap();
  }

[emirbaycan]

And i also tested it with this function and it worked

pub async fn test_login_handler( session: Session, State(data): State<Arc<AppState>>) 
-> Result<impl IntoResponse, (StatusCode, Json<serde_json::Value>)> {
 session.insert("logged_in",1).await.unwrap();
 let json_response = serde_json::json!({
  "status": "success",
 });
 Ok((StatusCode::OK, Json(json_response)))
}

[emirbaycan]

But on my frontend app

i used post request to login to login handler

login handler on the server side

pub async fn login_handler(
    session: Session,
    State(data): State<Arc<AppState>>,
    Json(body): Json<Login>,
) -> Result<impl IntoResponse, (StatusCode, Json<serde_json::Value>)> {
    let email = body.email.unwrap();
    let password = body.password.unwrap();

    let query_result = sqlx::query_as!(
        User,
        "SELECT id,username,email,password,fullname,role,avatar,active FROM users WHERE email=$1",
        email
    )
    .fetch_one(&data.db)
    .await;

    if query_result.is_err() {
        let error_response = serde_json::json!({
            "status": "fail",
            "message": "User not exists",
        });
        return Err((StatusCode::NOT_FOUND, Json(error_response)));
    }

    let item = query_result.unwrap();

    let password_hash = item.password.clone();
    let valid = verify(&password, &password_hash).unwrap();

    if !valid {
        let error_response = serde_json::json!({
            "status": "fail",
            "message": "Passwords did not match",
        });
        return Err((StatusCode::NOT_ACCEPTABLE, Json(error_response)));
    }

    let user = serde_json::json!({
        "id":item.id,
        "email":item.email,
        "username":item.username,
        "fullname":item.fullname,
        "password":"",
        "role":item.role,
        "avatar":item.avatar,
        "active":item.active
    });

    let json_response = serde_json::json!({
        "status": "success",
        "data": item
    });

    session.insert("logged_in",1).await.unwrap();

    Ok((StatusCode::OK, Json(json_response)))
}

post request to login from frontend app

const response = await fetch(import.meta.env.VITE_API_URL + 'auth/login', {
      method: 'POST',
      headers: {
        'Content-Type': 'application/json',
      },
      body: JSON.stringify(formData),
    })

    const result = await response.json()

    if (result.status == "success") {
      init({ message: "You've successfully logged in", color: 'success' })
      push({ name: 'dashboard' })
    }

middleware

pub async fn authenticate(
    session: Session,
    request: Request,
    next: Next,
) -> Result<Response, (StatusCode, impl IntoResponse)> {
    // Check if the user is logged in
    if let Ok(Some(logged_in)) = session.get::<usize>("logged_in").await {
        // If logged in, continue processing the request
        let response = next.run(request).await;
        Ok(response)
    } else {
        let error_response = serde_json::json!({
            "error": "Unauthorized",
        });
        Err((StatusCode::UNAUTHORIZED, Json(error_response)))
    }
}

router file that i implement the authentication

pub fn user_router(app_state: Arc<AppState>) -> Router {
    Router::new()
    .route("/api/users", get(user_list_handler))
    .route("/api/users", post(create_user_handler))
    .route(
        "/api/users/:id",
        get(get_user_handler)
        .patch(edit_user_handler)
        .delete(delete_user_handler),
    )
    .layer(middleware::from_fn(authenticate))
    .with_state(app_state)
}

But i got unauthorized error on the pages where my middleware checks the logged_in value

[maxcountryman]

You need to tell fetch to include the cookies. For example:

fetch(url, {
credentials: "same-origin"
})

[emirbaycan]

When i used this it worked thank you, have a nice day

credentials: "include"

[emirbaycan]

Here is the project link https://github.com/kalinux0/simple-rust-usage