Changes.md

Changelog

All notable changes to lua-resty-session will be documented in this file.

[3.8] - 2021-01-04

Added

• Connection options are now passed to redis cluster client as well.

[3.7] - 2020-10-27

Fixed

• Fix #107 where session.start could release a lock for a short period

Added

• Add keep_lock argument to session.open
• Add pluggable compressors, and implement none and zlib compressor

[3.6] - 2020-06-24

Fixed

• Fix session:hide() to only send a single Cookie header at most as reported by @jharriman who also provided a fix with #103. Thank you!

[3.5] - 2020-05-22

Fixed

• Fix session:hide() to not clear non-session request cookies that it seemed to do in some cases as reported by @altexy who also provided initial fix with #100. Thank you!

[3.4] - 2020-05-08

Fixed

• Fix session_cookie_maxsize - error attempt to compare string with number, fixes #98, thank you @vavra5

Changed

• More robust and uniform configuration parsing

[3.3] - 2020-05-06

Fixed

• Fix set_timeouts is only called if all parameters are available, should fix #96, thank you @notdodo.

Added

• Add $session_memcache_connect_timeout configuration option
• Add $session_memcache_read_timeout configuration option
• Add $session_memcache_send_timeout configuration option
• Add $session_memcache_pool_name configuration option
• Add $session_memcache_pool_backlog configuration option
• Add $session_dshm_connect_timeout configuration option
• Add $session_dshm_read_timeout configuration option
• Add $session_dshm_send_timeout configuration option
• Add $session_dshm_pool_name configuration option
• Add $session_dshm_pool_backlog configuration option

[3.2] - 2020-04-30

Added

• Support for Redis clusters
• Add $session_redis_connect_timeout configuration option
• Add $session_redis_read_timeout configuration option
• Add $session_redis_send_timeout configuration option
• Add $session_redis_pool_name configuration option
• Add $session_redis_pool_backlog configuration option
• Add $session_redis_cluster_name configuration option
• Add $session_redis_cluster_dict configuration option
• Add $session_redis_cluster_maxredirections configuration option
• Add $session_redis_cluster_nodes configuration option

[3.1] - 2020-03-28

Added

• A more flexible way to specify custom implementations: require "resty.session".new { storage = require "my.storage" }

[3.0] - 2020-03-27

Fixed

• Lock releasing is a lot more robust now

Added

• Add idletime setting (thanks @Tieske), see session.cookie.idletime
• Add support for Cookie prefixes __Host- and __Secure- on Cookie name (see: https://tools.ietf.org/html/draft-ietf-httpbis-rfc6265bis-05#section-4.1.3)

Changed

• The whole codebase was refactored and simplified, especially implementing new storage adapters is now a lot easier
• Redis and Memcached spinlockwait was changed from microseconds to milliseconds and default is set to 150 milliseconds,
• Redis and Memcache will only release locks that current session instance holds
• DSHM session_dshm_store was renamed to session_dshm_region
• BASE64 encoding now strips the padding

[2.26] - 2020-02-11

Added

• Add support for SameSite=None (#83) (thanks @bodewig)
• Style changes (#77) (thanks @Tieske)

[2.25] - 2019-11-06

Added

• Add SSL support for the Redis storage option (#75) (thanks @tieske)
• DSHM storage adapter (a distributed SHM storage based on Hazelcast for Nginx) (thanks @grrolland)

[2.24] - 2019-07-09

Fixed

• Avoid use unix socket and redis password with empty string
• Provide session id when closing, otherwise the lock is not deleted

Added

• Added a configuration for session cookie max size (session.cookie.maxsize)

[2.23] - 2018-12-12

Added

• Added pluggable strategies with default and a new regenerate strategy
• Added pluggable hmacs
• Added session.close
• Added ttl to storages
• Added session.cookie.discard, a ttl how long to keep old sessions when renewing (used by regenerate strategy

[2.22] - 2018-03-17

Fixed

• Only sets self.cookie.secure if not defined.

[2.21] - 2018-03-16

Screwed

• Forgot to bump version number.

[2.20] - 2018-03-16

Fixed

• Fixes issue where check addr and check scheme could be faked. See also: bungle#47 Thanks @nielsole

[2.19] - 2017-09-19

Fixed

• Fixes small bug where aes could generate invalid salt on invalid input that further crashes Lua with error: bad argument #2 to 'salt' (number expected, got no value)

[2.18] - 2017-07-10

Fixed

• Automatically creates exactly 64 bits salt as required by the latest lua-resty-string. See also: bungle#40 Thanks @peturorri

[2.17] - 2017-06-12

Added

• Added session.hide() function to hide session cookies from upstream on reverse proxy scenarios.

[2.16] - 2017-05-31

Changed

• Delays setting the defaults until needed, allowing users to safely require "resty.session" in different contexts.

[2.15] - 2017-02-13

Added

• Added a support for chunked cookies. See also: bungle#35 Thanks @zandbelt

[2.14] - 2016-12-16

Fixed

• Lua code configuration parsing corrections (especially on boolean options).

Added

• Added a more natural way to pass config arguments to storage adapters and ciphers in Lua code. See also: bungle#34 Thanks @hanxi

[2.13] - 2016-11-21

Changed

• On start we do send cookie now also if the settings have changed and the cookie expiry time needs to be reduced.

Fixed

• Memcache storage adapter had a missing ngx.null.

[2.12] - 2016-11-21

Added

• Implemented pluggable session identifier generators.
• Implemented random session idenfier generator.

Changed

• Now checks if headers were already sent before trying to set the cookie headers.
• SSL session identifier is not checked by default anymore.
• Lua session.identifier.length changed to session.random.length.
• Nginx $session_identifier_length changed to $session_random_length.

[2.11] - 2016-09-30

Changed

• Just another OPM release to correct the name.

[2.10] - 2016-09-29

Added

• Support for the official OpenResty package manager (opm).

Changed

• Changed the change log format to keep-a-changelog.

[2.9] - 2016-09-01

Fixed

• Bugfix: Weird bug where RAND_bytes was not working on Windows platform. Code changed to use resty.random. See Also: bungle#31 Thanks @gtuxyco

[2.8] - 2016-07-05

Fixed

• Bugfix: AES Cipher used a wrong table for cipher sizes. See Also: bungle#30 Thanks @pronan

[2.7] - 2016-05-18

Added

• Redis storage adapter now supports Redis authentication. See Also: bungle#28 Thanks @cheng5533062

[2.6] - 2016-04-18

Changed

• Just cleanups and changed _VERSION to point correct version.

[2.5] - 2016-04-18

Fixed

• session.save close argument was not defaulting to true.

[2.4] - 2016-04-17

Added

• Cookie will now have SameSite attribute set as "Lax" by default. You can turn it off or set to "Strict" by configuration.

Changed

• Calling save will now also set session.id if the save was called without calling start first. See Also: bungle#27 Thanks @hcaihao

[2.3] - 2015-10-16

Fixed

• Fixes issue #19 where regenerating session would throw an error when using cookie storage. See Also: bungle#19 Thanks @hulu1522

[2.2] - 2015-09-17

Changed

• Removed all session_cipher_* deprecated settings (it was somewhat broken in 2.1).
• Changed session secret to be by default 32 bytes random data See Also: bungle#18 Thanks @iain-buclaw-sociomantic

Added

• Added documentation about removed features and corrected about session secret size accordingly.

[2.1] - 2015-09-07

Added

• Added architecture for Cipher adapter plugins. See Also: bungle#16 Thanks @mingfang
• Implemented AES cipher adapter (just like it was before)
• Implemented None cipher adapter (no encryption)
• Added documentation about pluggable ciphers

Changed

• Changed JSON serializer to use cjson.safe instead

[2.0] - 2015-08-31

Added

• Added architecture for Storage adapter plugins. See Also: bungle#13
• Implemented Client Side Cookie storage adapter.
• Implemented Memcache storage adapter. See Also: bungle#14 Thanks @zandbelt
• Implemented Redis storage adapter.
• Implemented Shared Dictionary (shm) storage adapter.
• Added architecture for Encoder and Decoder plugins.
• Implemented Base 64 encoder / decoder.
• Implemented Base 16 (hex) encoder / decoder.
• Added architecture for Serializer plugins
• Implemented JSON serializer.
• Persistent cookies will now also contain Max-Age in addition to Expires.
• Cookie domain attribute is not set anymore if not specified.
• Added notes about using lua-resty-session with Lua code cache turned off. See also: bungle#15 Thanks @BizShuk

[1.7] - 2015-08-03

Added

• Added session.open() function that only opens a session but doesn't send the cookie (until start is called). See also: bungle#12 Thanks @junhanamaki

Fixed

• Fixed cookie expiration time format on Firefox bug: bungle#10 Thanks @junhanamaki
• Bugfix: Fixed an issue of overwriting a variable: bungle#11 Thanks @junhanamaki

[1.6] - 2015-05-05

Fixed

• Fixed truncated cookie value bug: bungle#8 Thanks @kipras

[1.5] - 2014-11-27

Fixed

• Cookies are not always "secure": bungle#5 Thanks @vladimir-smirnov-sociomantic

Added

• Added documentation about Nginx SSL/TLS configuration settings related to session lifetime and ssl session ids.

[1.4] - 2014-11-26

Fixed

• Bugfix: Fixed an issue where session configurations did get cached on a module level. This issue is discussed in pull-request #4: bungle#4 Thanks @kipras.

Added

• Added session.new function.
• Added documentation about Nginx configuration used as defaults (not read on every request), and documented session.new.

Changed

• session.start{ ... } (a call with config parameters) works now as expected.
• session.start now returns additional extra boolean parameter that can be used to check if the session is s new session (false) or a previously started one (true).

[1.3] - 2014-11-14

Added

• Added support for persistent sessions. See issue #2.
• Added session.check.ssi, session.cookie.persistent and the related Nginx configuration variables.
• Added Max-Age=0 to expiration code.

[1.2] - 2014-10-12

Fixed

• Changed encode and decode functions to operate with correct number of arguments. See issue #1.

[1.1] - 2014-10-03

Security

• There was a bug where additional user agent, scheme, and remote addr (disabled by default) was not checked.

Added

• Added _VERSION field.

Changed

• Simplied a code a lot (e.g. internal setcookie and getcookie functions are now cleaner). Removed a lot of unneccessary lines from session.start by adding configs directly to session prototype.

[1.0] - 2014-09-24

Added

• LuaRocks Support via MoonRocks.