1. http-session
    1. Introduction
    2. Author
    3. Repository
    4. Requirements
    5. API
      1. Parameters
        1. session-lifetime
        2. session-id-generator
        3. match-ip-address?
      2. Procedures
        1. session-create
        2. session-refresh!
        3. session-valid?
        4. session-destroy!
        5. session-ref
        6. session-set!
        7. session-del!
        8. session-bindings
        9. session-set-finalizer!
    6. Configurable storage backend API
      1. session-storage-initialize
      2. session-storage-set!
      3. session-storage-ref
      4. session-storage-delete!
    7. File-based backend storage example
    8. Usage example
      1. Web server
    9. License
    10. Version History
      1. Version 2.9
      2. Version 2.8
      3. Version 2.7
      4. Version 2.6
      5. Version 2.5
      6. Version 2.4
      7. Version 2.3
      8. Version 2.2
      9. Version 2.1
      10. Version 2.0
      11. Version 1.2.3
      12. Version 1.2.2
      13. Version 1.2
      14. Version 1.1
      15. Version 1.0


http-session is an implementation of facilities for managing HTTP sessions of web applications.


Mario Domenech Goulart



simple-sha1, spiffy



[parameter] (session-lifetime [number])

The lifetime of sessions in seconds. Default is 3600s (1h).

[parameter] (session-id-generator [procedure])

A zero argument procedure which generates a random unique identifier for sessions. Defaults to a procedure which concatenates current-milliseconds with the process ID and a random number between 0 and 1000 plus the current-process-id and returns its SHA-1 digest.

[parameter] (match-ip-address? [boolean])

Indicates whether http-session should match IP addresses to check if sessions are valid.


[procedure] (session-create #!optional (bindings '()))

Creates a session and returns the session identifier.

The optional bindings argument is an alist '((symbol . value)...) of variable bindings valid for the generated session.

[procedure] (session-refresh! sid)

Refreshes the session identified by sid, that is, sets the lifetime of the session identified by sid to (session-lifetime).

[procedure] (session-valid? sid)

Returns #t if the session identified by sid is valid. Returns #f otherwise.

A session is valid if (all items should be satisfied):

[procedure] (session-destroy! sid)

Destroys the session identified by sid.

[procedure] (session-ref sid var #!optional default)

Returns the value corresponding to VAR from the bindings alist of the session identified by sid. If the binding does not exist, DEFAULT is returned.

[procedure] (session-set! sid var val)

Sets a value VAL for the VAR symbol in the bindings alist for the session identified by sid. If the symbol does not exist in the bindings alist, it is added to it.

[procedure] (session-del! sid var)

Deletes the VAR symbol and its corresponding value from the bindings alist of the session identified by sid.

[procedure] (session-bindings sid)

Returns an alist '((variable . value) ... ) representing the bindings of the session identified by sid.

[procedure] (session-set-finalizer! sid proc)

Sets a finalizer procedure (proc) for the session identified by sid. proc is an one-argument procedure which receives the session identifier as argument and is executed right before the session is destroyed.

Configurable storage backend API

[parameter] (session-storage-initialize)

A procedure that returns the session storage. The object returned by the default procedure is a hash-table.

[parameter] session-storage-set!

A two-argument procedure (sid and session-item) that sets the given session-item in the session storage for sid.

[parameter] session-storage-ref

A one-argument procedure that given the session identifier returns the corresponding session item.

[parameter] session-storage-delete!

A one-argument procedure that deletes the session item correspoding to the given session identifier.

File-based backend storage example

Here's an example using awful. http-session keeps the session in a file-based backend storage.

 (use awful http-session)
 (define (session-item->list session-item)
   (list (session-item-expiration session-item)
         (session-item-ip session-item)
         (session-item-bindings session-item)
         (session-item-finalizer session-item)))
 (define (list->session-item l)
   (apply make-session-item l))
  (lambda ()
    (let ((dir (create-temporary-directory)))
      (print "Using " dir " as sessions-dir.")
  (lambda (sid session-item)
    (with-output-to-file (make-pathname (session-storage) sid)
      (lambda ()
        (pp (session-item->list session-item))))))
  (lambda (sid)
    (let ((data (with-input-from-file
                    (make-pathname (session-storage) sid)
      (list->session-item data))))
  (lambda (sid)
    (delete-file* (make-pathname (session-storage) sid))))
 ;; awful pages
 (define-session-page (main-page-path)
   (lambda ()
     (with-request-variables (foo)
       ($session-set! 'foo foo)
       (string-append "foo set to " (->string foo)))))
 (define-session-page "/foo"
   (lambda ()
     (->string ($session 'foo))))

Usage example

Web server

(use spiffy web-scheme-handler http-session html-tags html-utils spiffy-request-vars)
(file-extension-handlers `(("ws" . ,web-scheme-handler)))

(define (page:next sid)
    (<h1> (let ((n (add1 (session-ref sid 'n 0))))
            (session-set! sid 'n n)
            (number->string n)))
    (<a> href: (string-append "?sid=" sid) "Next"))))

(let ((sid ((request-vars) 'sid)))
  (if sid
      (if (session-valid? sid)
          (begin (session-refresh! sid)
                 (page:next sid))
          (html-page "Invalid session."))
      (let ((sid (session-create)))
        (page:next sid))))



Version History

Version 2.9

Version 2.8

Version 2.7

Version 2.6

Version 2.5

Version 2.4

Version 2.3

Version 2.2

Version 2.1

Version 2.0

Version 1.2.3

Version 1.2.2

Version 1.2

Version 1.1

Version 1.0