Walkthrough

The session middleware's fresh-flag initialization was changed so sessions are only marked fresh when a new ID is generated; previously an ID found in locals marked the session fresh. One existing test expectation was updated and three new tests were added to cover fresh-flag, CSRF, and repeated getSession call scenarios.

Changes

Sequence Diagram(s)

sequenceDiagram
    participant Client
    participant Handler as Request Handler
    participant SessionMW as Session Middleware
    participant Store as Session Store

    Note over SessionMW,Store: Fresh flag now only true when Store generates a new ID

    rect rgb(240,248,255)
    Note over Client,Store: Existing session flow
    Client->>Handler: Request with session cookie
    Handler->>SessionMW: getSession(ctx)
    SessionMW->>Store: check locals for ID
    Store->>Store: ID found in locals
    Store->>Store: set fresh := false
    Store->>Store: load session data (if present & not expired)
    Store-->>SessionMW: return session (fresh=false)
    end

    rect rgb(240,255,240)
    Note over Client,Store: New session flow
    Client->>Handler: Request without session
    Handler->>SessionMW: getSession(ctx)
    SessionMW->>Store: check locals for ID
    Store->>Store: no ID -> generate new ID
    Store->>Store: set fresh := true
    Store-->>SessionMW: return session (fresh=true)
    end

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

• Single-line semantic change in middleware/session/store.go.
• Multiple new tests added in middleware/session/session_test.go; run tests and inspect CSRF/expiry scenarios.
• Pay attention to:
  • middleware/session/store.go — fresh flag logic, ID generation, locals handling.
  • middleware/session/session_test.go — test correctness around repeated getSession() and expiry.

Possibly related PRs

• test(middleware/session): Remove extra release and aquire ctx calls in session_test.go #3043 — touches session middleware and tests; likely overlaps with getSession/store freshness behavior.

Suggested labels

SessionMW

Suggested reviewers

• gaby
• ReneWerner87
• efectn

Poem

🐰 I hop through code with whiskers bright,
IDs appear only when none are in sight,
Freshness saved for newborn sessions' cheer,
Tests munch carrots to keep behavior clear,
Hooray for stable IDs — hop, hop, hooray! 🥕

Pre-merge checks and finishing touches

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

Summary of Changes

Hello @sixcolors, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request addresses a critical bug in the session middleware's fresh flag logic that caused Fresh() to return an incorrect value under specific conditions. Previously, an existing session could be mistakenly identified as 'fresh' if its ID was found in the request's local context, particularly when getSession() was invoked multiple times. The fix ensures that the fresh flag accurately reflects whether a session is truly new or has been regenerated, thereby restoring correct session state detection and preventing issues in scenarios such as CSRF validation.

Highlights

• Bug Fix: Incorrect Fresh Flag Logic: Resolved a bug in the session middleware where the fresh flag was incorrectly set to true when a session ID was found in context locals, leading to Fresh() returning an incorrect value for existing sessions, especially when getSession() was called multiple times within a single request.
• Corrected Fresh Flag Assignment: The fresh flag initialization in getSession() was changed from fresh := ok to fresh := false. This ensures fresh is only set to true when a new session is genuinely created (via acquireSession()) or regenerated (via refresh()), aligning with expected behavior.
• New Comprehensive Tests Added: Three new tests (Test_Session_Fresh_Flag_Bug, Test_Session_CSRF_Scenario, Test_Session_Multiple_GetSession_Calls) were introduced to thoroughly verify the fix, covering scenarios like multiple getSession() calls, CSRF validation, and expired sessions.
• Existing Test Updated: The Test_Session_Cookie_In_Middleware_Chain test was updated to reflect the correct fresh flag expectation for an existing session, changing require.True(t, sess.Fresh()) to require.False(t, sess.Fresh()).

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 92.18%. Comparing base (83cc132) to head (919fd56).
⚠️ Report is 1 commits behind head on main.

@@            Coverage Diff             @@
##             main    #3825      +/-   ##
==========================================
- Coverage   92.20%   92.18%   -0.03%     
==========================================
  Files         115      115              
  Lines        9671     9671              
==========================================
- Hits         8917     8915       -2     
- Misses        482      483       +1     
- Partials      272      273       +1     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

@codex review

Codex Review: Didn't find any major issues. Hooray!