slaesvuo/hledger
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

web: don't write a session file at startup

Browse Source 
The .hledger-web_client_session_key.aes file written at startup is
cluttersome and means hledger-web can only be started from a writable
directory. What do we lose if I disable it ?

https://hackage.haskell.org/package/yesod-core-1.4.33/docs/Yesod-Core.html#v:makeSessionBackend
says "Default: Uses clientsession with a 2 hour timeout."
http://hackage.haskell.org/package/clientsession-0.9.1.2 says
"Securely store session data in a client-side cookie."

I think: hledger-web saves (eg) the state of the sidebar as session
data, in a cookie, and my web browser saves that locally. And this
still seems to work, across server restarts. So what's the purpose of
saving this "client session" file on the server ? Let's disable it and
find out.
This commit is contained in:
Simon Michael 2017-12-29 10:53:41 -08:00
parent ecdbc05703
commit e9ff1280d7
1 changed files with 7 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
hledger-web/Foundation.hs
View File

@ -100,11 +100,13 @@ type Form x = Html -> MForm (HandlerT App IO) (FormResult x, Widget)
instance Yesod App where instance Yesod App where
approot = ApprootMaster $ appRoot . settings approot = ApprootMaster $ appRoot . settings
-- Store session data on the client in encrypted cookies, -- -- Store session data on the client in encrypted cookies,
-- default session idle timeout is 120 minutes -- -- default session idle timeout is 120 minutes
makeSessionBackend _ = fmap Just $ defaultClientSessionBackend -- makeSessionBackend _ = fmap Just $ defaultClientSessionBackend
(120 * 60) -- (120 * 60)
".hledger-web_client_session_key.aes" -- ".hledger-web_client_session_key.aes"
-- don't use session data
makeSessionBackend _ = return Nothing
defaultLayout widget = do defaultLayout widget = do
master <- getYesod master <- getYesod