forgejo/modules/session
Nils Goroll 31fff54e17
Improvement: Do not set session cookie for empty session
This is based on https://code.forgejo.org/go-chi/session/pulls/80.

The remainder of this message is largely copied from there:

For interoperability with reverse proxies and CDNs, setting a session
cookie for no good reason (login is a good reason) is a PITA, because it
makes caching of content for anonymous (not logged-in) users very hard,
requiring all kinds of special casing and error prone workarounds.

In particular in an age of exploitative AI bot crawling, being able to
serve content for anonymous users from a fast, efficient page cache is
an important option.

This patch lays a foundation by using an option added to go-chi/session
to not create session cookies always, but rather only when the
respective session is non-empty.

Test cases are included there and omitted here.
2026-03-11 04:18:06 +01:00
..
db.go Improvement: Do not set session cookie for empty session 2026-03-11 04:18:06 +01:00
redis.go Improvement: Do not set session cookie for empty session 2026-03-11 04:18:06 +01:00
store.go [CHORE] Move to new sessioner library 2024-08-25 03:47:08 +02:00
virtual.go Improvement: Do not set session cookie for empty session 2026-03-11 04:18:06 +01:00