Server-side session example

This example site demonstrates using # serversession # with Yesod and Persistent.

Current session properties

Session ID

#{maybe "-- no session --" id msid}

Session variables

$if null vars -- no session variables -- $else $forall (key, val) <- vars

Key	Value
#{show key}	#{show val}	Delete # Adding or modifying session variables ^{sessionAddFormWidget} Forcing invalidation of the session The serversession package supports session # invalidation destroying the current session ID and creating a # new one. This is used to avoid session fixation attacks, where # an attacker convinces a victim to use the same session ID as # his and asks the victim to log in. If the session is not # invalidated upon login, the attacker will now be in possession # of a session ID that is logged in as the victim. If the # session is invalidated, the victim receives a new session ID # that the attacker doesn't have any knowledge of. Session # invalidation is also useful to logout the user from all of its # sessions after changing their password, for example. Use the form below to force a session invalidation to occur. # Note that the contents of this session are not lost! ^{forceFormWidget}