Dunno if it is documented, but if add a :recreate key to the session middleware with a truthy value it will delete and create a new session

https://github.com/ring-clojure/ring/blob/master/ring-core/src/ring/middleware/session.clj#L48

The key name for the session is added here https://github.com/ring-clojure/ring/blob/master/ring-core/src/ring/middleware/session.clj#L31

thank you

It's documented in the wiki (https://github.com/ring-clojure/ring/wiki/Sessions) but should also probably be in the docstring of wrap-session.

thank you. If I ever get some free time I would like to improve the docs. Clojure tools / libs generally lack begginner friendly documentation IMO 😞

during my work integrating pac4j (ongoing) I also think an alternative session implementation where the store is passes out of band and not via request / response maps might be ok as well. pac4j expects a mutable session store (because of Servlet API) and I have to work around that .

having just the session ID on req / response and passing the store out of band to the handlers might be a solution

Some sessions are updated via the HTTP response (e.g. serialized session data in encrypted cookies), rather than via some side-channel (such as a database). Ring targets the lowest common denominator.

However, you can always add middleware to supply a mutable session, e.g.

(defn wrap-mutable-session [handler]
  (fn [request]
    (let [session  (atom (:session request))
          request  (assoc request :mutable-session session)
          response (handler request)]
      (assoc response :session @session))))

yes, that is true, but the issue I find is that the ecosystem around this is missing in Clojure /ring . take for example ring-session-timeout - it expects the session to be under :session key so it will update that and you get into a divergent sitution https://github.com/ring-clojure/ring-session-timeout/blob/2cf787cb05caebe66c3af5201aaf0c517601f03e/src/ring/middleware/session_timeout.clj#L40 . IMO it would be nice if the session protocol was more extensive and hid the session details from the user. e.g. get-session-id [req] for example could hide the session key from user / implementors. get-session [req] could do the same ?! I can only come up with mutable API's - sorry . My point is, having session under :session - is an implementation detail that should be hidden from users. This can free middleware implementors to store session how they want.

The wrap-mutable-session example above will work with ring-session-timeout, as long as ring-session-timeout wraps it.

Can you tell me a little more about what you're trying to do, and why you need a mutable session store?

sure. I can tell you why I THINK I need it - I don't know if I really do 🙂

I have this WIP ring pac4j implementation that I am working on https://github.com/netdava/snm/blob/main/dev/ring_pac4j.clj .

pac4j seesm to have a lot of available Auth Clients

I have auth working - code is rough, mind your step

here is how you can test it https://clojurians.slack.com/archives/C03S1KBA2/p1718429183314859?thread_ts=1718426363.999819&cid=C03S1KBA2

I don't have role assignement to user - so you can't access the /protected link - but you do get rejected proeprly

If I'm understanding correctly, pac4j is some sort of security framework, and to interface with it you need Java objects for sessions, cookies, etc.

yes, in a nutshell

in this case, having both :session and the external session store is more work than having just the external session store

the :session approach has merit with regards to external (redis) session stores - in the sense that local session is local until the response is sent and then it gets written to the external store

Is the pac4j session store required only for the lifespan of the handler? Or to put it another way, can it be updated after the response is returned?

I will have to think about that. I think so. Right now I keep a request + response as atoms and update those and then merge back in the response once it's done. But I just started with this so not sure if it will work with all cases. https://github.com/netdava/snm/blob/a6d257697516336a88cedb38ccd7f05abe813da5/dev/ring_pac4j.clj#L245

and https://github.com/netdava/snm/blob/a6d257697516336a88cedb38ccd7f05abe813da5/dev/ring_pac4j.clj#L430

I don't know anything about pac4j, but can't you do something like:

(defn wrap-pac4j [handler options]
  (fn [request]
    (let [config  (make-pac4j-config options)]
          context (make-pac4j-context request)]
      (do-side-effectful-pac4j-stuff config context)
      (let [response (handler request)]
        (merge-pac4j-response response config context)))))

thanks

I'll see what I can do and hopefully I will get it working and ask for some feedback to publish it

Good luck!

thanks