Finalize session state after running delayed responses.

We want to allow delayed-response code to run before we decide whether to
do things like expiring the session cookie. If session finalization is run
before then, any session settings made by delayed code will be ignored.

The previous implementation (a specialization on FINALIZE-STATE for
function responses) is insufficient, because while the expiration itself is
deferred, the decision whether to expire the session is still performed
befored delayed-response code has run.
This commit is contained in:
Matthew Stickney 2017-01-23 01:00:26 -05:00
parent 50c4f1bbbb
commit 84472bc475

View file

@ -35,12 +35,18 @@
(if new-session-p (if new-session-p
(list :id sid :new-session t :change-id nil :expire nil) (list :id sid :new-session t :change-id nil :expire nil)
(list :id sid :new-session nil :change-id nil :expire nil))) (list :id sid :new-session nil :change-id nil :expire nil)))
(let ((res (funcall app env))) (let ((res (funcall app env))
(if (and (not keep-empty) (process-session (lambda (result)
new-session-p (if (and (not keep-empty)
(zerop (hash-table-count session))) new-session-p
res (zerop (hash-table-count session)))
(finalize store state env res)))))) result
(finalize store state env result)))))
(typecase res
(function (lambda (responder)
(funcall res (lambda (result)
(funcall responder (funcall process-session result))))))
(t (funcall process-session res)))))))
"Middleware for session management") "Middleware for session management")
(defun finalize (store state env res) (defun finalize (store state env res)